AT&T Fined $177M for Two Customer Data Breaches

Key Takeaways

• AT&T has been ordered to pay $177 million to resolve legal actions stemming from two significant customer data breaches in 2024.
• The breaches collectively impacted over 73 million current and former AT&T customers, exposing sensitive personal and call record data.
• The first incident involved data from 2019 or earlier, appearing on the dark web, while the second stemmed from unauthorized access to an AT&T workspace on Snowflake’s cloud platform.
• Affected individuals can receive compensation for documented losses, with varying maximum payouts depending on the breach and the type of information exposed.

AT&T is set to disburse $177 million following a federal judge’s final approval on October 2, 2026, to settle class-action lawsuits related to two distinct customer data breaches disclosed earlier in 2024. These incidents compromised personal details and communication records, creating significant privacy risks for millions of past and present subscribers.

U.S. District Court Judge Sidney A. Fitzwater, presiding over the Northern District of Texas, formally sanctioned the settlement, as reported by Bloomberg Law. AT&T agreed to the resolution without admitting any liability or wrongdoing. The settlement allocates $149 million for the initial breach and $28 million for the second, with legal and administrative costs also drawn from these funds.

Two Separate Incidents Compromised Diverse Customer Information

First Breach: Dark Web Data Exposure

The first breach came to light on March 30, 2024, after customer data surfaced on the dark web. AT&T’s initial investigation indicated that approximately 7.6 million active accounts and 65.4 million former accounts were affected, totaling 73 million individuals. The company noted that the exposed records appeared to originate from 2019 or earlier.

The compromised data varied per individual but could include full names, physical addresses, email addresses, telephone numbers, dates of birth, account passcodes, billing account numbers, and Social Security numbers. Initially, AT&T stated it had no evidence of unauthorized access to its internal systems and was investigating whether the data originated from the company directly or from a third-party vendor.

Second Breach: Snowflake Cloud Platform Incident

A second, separate breach was announced on July 12, 2024. This incident involved records exfiltrated from an AT&T workspace hosted on Snowflake’s cloud platform. Attackers gained access to this workspace between April 14 and April 25, 2024, impacting nearly all AT&T cellular customers, as previously detailed in reporting on the AT&T call-record breach.

The information compromised in this second event included call and text metadata from May through October 2022, along with some records from January 2, 2023. This data encompassed phone numbers, interaction counts, total call durations, and certain cell tower identifiers. Crucially, this breach did not expose Social Security numbers or the actual content of communications.

The nature of these communication records is significant, as they can reveal patterns of association even without message content. AT&T acknowledged that publicly available online tools could link phone numbers to specific individuals. It was also previously reported that AT&T paid approximately $370,000 to have these stolen records deleted, though residual fragments might still exist elsewhere.

According to the official settlement terms, eligible claimants from the first breach could claim up to $5,000 for documented losses directly attributable to that incident. Those affected by the second breach were eligible for up to $2,500. Customers impacted by both events could qualify for both tiers of compensation but were required to provide distinct evidence for each claim and could not claim the same loss twice.

It is important to note that these figures represent maximum potential payouts, not guaranteed sums. Expected standard cash payments were considerably lower, with estimates ranging from $6.50 to $40, depending on the claim tier. Individuals whose Social Security numbers were exposed qualified for a higher compensation tier compared to those whose other personal details were leaked.

The deadline for submitting claims passed on December 18, 2025, meaning new claims can no longer be filed through this specific process. Payments are contingent upon claim review and an appeals process, with no confirmed distribution date publicly reported. Customers are advised to monitor official updates from AT&T and remain vigilant against phishing attempts exploiting the leaked information.

What You Should Do

• Monitor Financial Accounts: Regularly review bank statements, credit card activity, and credit reports for any suspicious or unauthorized transactions.
• Enable Multi-Factor Authentication (MFA): Implement MFA on all online accounts, especially for banking, email, and social media, to add an extra layer of security.
• Change Passwords: Update passwords for AT&T accounts and any other online services where you may have used similar credentials, opting for strong, unique passwords.
• Beware of Phishing: Exercise extreme caution with unsolicited emails, texts, or calls, particularly those claiming to be from AT&T or related to the data breaches, as they could be phishing attempts.
• Review Privacy Settings: Periodically check and adjust privacy settings on your online accounts to limit the amount of personal information publicly accessible.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.