AT&T data-breach settlement may pay some customers as much as $5,000

AT&T experienced two significant security breaches in 2024, each of which exposed customer information to unauthorized parties.

The fallout led to a class-action lawsuit, and a federal judge has now given final approval to a $177 million settlement for customers who filed claims on time.

How much a person may receive depends on the settlement group they qualify for and whether they provided proof of losses when filing. Some claimants could be paid up to $5,000, while others will get less or receive a proportional share of the remaining fund after expenses are deducted. The final amount will not be determined until payments are issued.

The claim deadline has passed. Anyone who already filed can check their status at TelecomDataSettlement.com. Below is a summary of what the settlement includes, how payouts are determined, and what to expect before the money is sent out.

What the two AT&T breaches exposed

The first breach became public when AT&T said a data set containing customer information had surfaced on the dark web.

The company said the exposed material included Social Security numbers, account numbers, passcodes, email addresses, and birth dates for about 73 million current and former customers.

AT&T later said that limited data had been unlawfully downloaded from its workspace on a third-party cloud platform. That material consisted of call and text records covering nearly all wireless customers and spanning May through October 2022.

The lawsuit claimed AT&T did not have adequate cybersecurity protections in place before either incident. While the company denied wrongdoing, it chose to settle instead of taking the case to trial.

The U.S. District Court for the Northern District of Texas approved the settlement on Oct. 2. If no appeal is filed, the agreement becomes effective on Nov. 12. An appeal would delay that date and push back payments by however long the appeals process lasts.

How much money claimants may get

Payment amounts depend on which of the two settlement classes a claimant falls into. The classes are based on when documented losses occurred, not on which breach caused them.

The first class covers documented losses from 2019 or later. Claimants in this group may receive up to $5,000. Eligible documentation can include records of identity theft, fraud losses, credit-monitoring expenses, or other out-of-pocket costs tied to the breach.

The more complete the documentation, the closer a payment may be to the maximum amount.

The second class applies to documented losses occurring on or after April 14, 2024, with payments capped at $2,500.

Claimants who did not document a specific financial loss may have chosen the pro rata option instead. That option provides a share of whatever remains in the $177 million fund after administrative costs, attorney fees, and service awards are paid.

Those pro rata payments will be smaller than the documented-loss awards, and the exact amount will depend on how many people selected that option.

When payments are expected

Payments must be sent within 60 days of the effective date. Based on the estimated effective date, distributions should be completed by around mid-January.

People will receive either an electronic payment or a paper check, depending on the choice made when they filed. Anyone whose contact or banking information has changed should update it at TelecomDataSettlement.com before payments are distributed.

If a claim is already on file, the administrator will send payment after the effective date, provided no appeal is filed.

Those unsure whether a claim was accepted should use the settlement website to check. The administrator provides status updates there, not through unsolicited messages.

Be cautious about scams tied to the settlement

The filing window is closed, so no outside party can help submit a new claim or speed up a payout.

Any unexpected call, text, or email offering help with a settlement payment or promising to expedite a check should be treated as a scam.

Official updates will come from TelecomDataSettlement.com or directly from the settlement administrator. The administrator will not ask for payment details, Social Security numbers, or other personal information beyond what was already provided in the claim.

Even people who did not file a claim should take the breaches seriously. Data exposed in a security incident can be used for identity theft long after the original event.

It is wise to review credit reports from all three major bureaus and check for unfamiliar accounts or inquiries. Consumers are entitled to one free report from each bureau every week at AnnualCreditReport.com.

A credit freeze can stop new credit from being opened in your name without permission and is free to place or remove. A fraud alert is a less restrictive option that flags a file without fully blocking new accounts.

Either measure makes sense given how much information was exposed in the two breaches.