AT&T’s $177 million settlement covers lawsuits over two customer-data incidents disclosed in 2024.
A federal judge approved the agreement, but AT&T did not admit liability or wrongdoing.
For developers, the case is a useful reminder to distinguish a court-approved settlement from an admission of fault.
Of the total amount, $149 million relates to the first incident and $28 million to the second. The amounts will also cover legal and administrative costs.
The first incident was announced on March 30, 2024, when customer data was leaked online. AT&T initially estimated that it affected about 7,6 million current and 65,4 million former customers, for a total of about 73 million people. The records appear to date back to 2019 or earlier.
The information varied by individual and could include names, addresses, emails, phone numbers, dates of birth, account passwords, billing account numbers and Social Security numbers. AT&T initially said it had no evidence that the data came from unauthorized access to its systems. It was investigating whether it came from itself or an employee.
The second incident was announced on July 12, 2024. It involved files removed from an AT&T Snowflake workspace. The attackers had access there from April 14 to 25, 2024. The incident affected nearly all AT&T mobile customers.
The records covered calls and text messages from May to October 2022, as well as some data from January 2, 2023. They included phone numbers, the number of calls, the total duration of calls and, in some cases, cell tower data. They did not include Social Security numbers or the content of the calls and messages. AT&T acknowledged that publicly available tools can link phone numbers to names.
Eligible claimants can receive up to $5.000 for documented damages related to the first incident and up to $2.500 for damages related to the second. Those affected by both may be eligible for both awards, but must provide separate evidence. They cannot claim compensation twice for the same damage.
The maximum amounts are not paid automatically. Estimates for typical payments range from $6,50 to $40, depending on the category of the application. Those who had their Social Security number exposed are eligible to be placed in a higher category.
The application deadline has expired on December 18, 2025, at which time new applications cannot be submitted through this process. Payments are subject to the review of applications and the consideration of objections. No confirmed payment date has been announced.
Customers should monitor official updates and their accounts, as well as beware of misleading messages that may exploit the exposed information.
Top comments (1)
tr.ee/dev-to