Millions of AT&T customers may file cash‑payment claims of up to $7,500 under a $177 million settlement tied to 2024 data breaches.
The wireless carrier suffered two data breaches announced in March and July 2024, to which lawsuits have been filed.
Below are the key numbers and timelines.
On March 30, 2024, AT&T said it was investigating a data breach that occurred about two weeks earlier. The breach touched data dating back to 2019, including Social Security numbers, and data on 73 million current and former customers were found in a dark‑web dataset.
In August 2024, the company blamed the second breach on an “unauthorized download” from a third‑party cloud platform, disclosed in April. This breach affected phone numbers of “nearly all” AT&T customers and customers of providers that used AT&T networks from May 1 to October 31, 2022.
The settlement provides $149 million in cash to cover the first breach and $28 million in payments for the second breach.
AT&T customers whose data were involved in the breaches, or in both breaches, are eligible to file claims. According to the settlement site, notice of the right to file will be sent by email.
AT&T noted that Kroll Settlement Administration is notifying current and former customers.
The deadline to file a claim is November 18. The final hearing to approve the settlement is scheduled for December 3, and appeals after the court’s ruling may follow, and their consideration may take some time.
“Benefits for class members will begin after the settlement is court-approved and the appeal period ends.”
– Settlement Website
Three-stage payout details
Applicants whose data were involved in the March breach are eligible for up to $5,000. Claims must include documentation showing losses that occurred in 2019 or later and that “clearly trace back” to the AT&T breach.
Regarding the breach announced in July, cash payouts amount to up to $2,500. Documentation is required for “losses that occurred after April 14, 2024.”
A client who was affected by both breaches may receive up to $7,500, but documentation for each loss must be unique, according to the settlement site.
Alternatively, clients can file a claim for a payout at a certain tier. According to the settlement site, anyone whose Social Security number was disclosed in the March breach will receive five times as much as the second payout tier, including those also affected by other data. Those affected by the second breach will receive an equal share of the remaining funds.
“The amount of money available for cash payouts to class members is not known at this time.”
– Settlement Website
However, there is no guarantee that customers will receive a substantial payout.
“The amount of money available for cash payouts to class members is not known at this time.”
– Settlement Website
How AT&T Responded
AT&T, in a statement, denies liability claims “for these actions” dating from the breach, but “agreed to this settlement to avoid the costs and uncertainty of extended litigation.”
“We remain committed to protecting our customers’ data and maintaining their trust in us,” the company wrote.
In 2024, an AT&T spokesperson told CNN that the March breach “has nothing to do” with Lipnev’s announcement.
AT&T expects the settlement to be approved by the end of the year.
Eva Rotenberg contributed to this report.
In conclusion, readers should expect that court rulings and payments will proceed in stages, but the main goal of the settlement is to compensate affected customers and reduce the risk of similar breaches in the future.