AT&T $177 million data breach deal approved

A federal judge in the US District Court for the Northern District of Texas has granted final approval to a $177 million class-action settlement resolving claims tied to two AT&T data breaches disclosed in 2024. The decision clears the way for payments to millions of current and former customers whose personal information was exposed in the incidents.

The settlement is structured as two non‑reversionary funds totaling $177 million. One fund covers claims related to a March 2024 breach, and the other addresses losses stemming from a separate breach disclosed in July 2024.

The first incident was announced on March 30, 2024, after customer information was found in a dataset published on the dark web. The breach affected about 7.6 million current AT&T customers and 65.4 million former customers, exposing data such as Social Security numbers, addresses, and account passcodes, although the specific information varied by individual.

The second incident was disclosed on July 12, 2024, and involved the unauthorized downloading of call and text interaction records from an AT&T workspace hosted on a third‑party cloud platform. The July breach exposed telephone records and limited location‑related information for a subset of individuals.

The $177 million settlement is divided into $149 million allocated to the March 2024 incident and $28 million to the July 2024 incident. Settlement proceeds will be distributed across categories that distinguish between documented financial losses and tiered cash payments based on the type of data exposed.

Customers affected by the March incident can qualify for up to $5,000 in reimbursement for documented out‑of‑pocket losses directly linked to that breach. Those impacted by the July incident can receive up to $2,500 for documented losses tied to that event, and some individuals affected by both incidents may qualify in both categories if they submitted valid claims.

Eligible customers also had the option to seek tiered cash payments without showing financial losses, particularly where highly sensitive information such as Social Security numbers was compromised. These payments will represent a proportional share of the remaining funds after settlement administration costs, attorneys’ fees, and other court‑approved expenses.

The deadline to submit claims under the settlement was December 18, 2025, and new claims are no longer being accepted. More than 4.9 million claims were filed, with some rejected for reasons including late submission, duplication, suspected fraud, withdrawal, or ineligibility.

Under the settlement terms, payments must begin within 60 days after the agreement becomes effective. If no appeal delays the process, the settlement is expected to become effective around November 12, 2026, meaning approved claimants could begin receiving funds before the end of 2026, with some payments potentially arriving in early 2027.

The maximum reimbursement figures of up to $5,000 for the March breach and up to $2,500 for the July breach are not guaranteed. Actual payout amounts will depend on each claimant’s eligibility, the nature of their approved claim, the number of valid claims, and deductions for administrative and legal costs.