AT&T Data Breach Settlement: What Was Approved

The first incident involved customer data leaked on the dark web in March 2024, with records dating to about 2019, including Social Security numbers for about 73 million current and former customers. The second involved an illegal download from a third-party cloud platform in 2024 of call and text metadata for nearly all cellular customers covering May 1 to October 31, 2022.

According to Mealey's and Gray Television stations, the combined settlement totals $177 million: $149 million for the first incident and $28 million for the second. Senior District Judge Sidney A. Fitzwater of the Northern District of Texas granted final approval on October 2, 2026.

Documented losses could be reimbursed up to $5,000 for the first incident and $2,500 for the second, with up to $7,500 for people in both, according to the reports. Typical payment estimates reported by Gray Television ranged from about $6.50 to $40, depending on the class and claims volume.

The claim deadline was December 18, 2025. Payments begin after any appeal period expires and claims are reviewed by the administrator. As of early October 2026, payment dates had not been announced, according to the reports reviewed.

Call and text records without content still reveal who communicated with whom, when, and how often. For some people, such as those in sensitive roles or relationships, this can be highly revealing. The incident is a reminder that metadata deserves protection comparable to content.

The second incident involved data held on a third-party cloud platform. Organisations must secure their accounts on such platforms with strong authentication, network restrictions, and monitoring, since the platform's own security does not protect against stolen customer credentials.

The first incident involved records dating back years, including former customers. Retaining old data increases breach impact. Retention limits and deletion of former customers' sensitive data reduce exposure.

Settlements, legal costs, and remediation make breaches expensive long after the incident. Investments in data minimisation, access controls, and monitoring look different when compared with nine-figure settlement totals.

Watch for communications from the official settlement administrator, be wary of scams impersonating settlement payments, and never pay a fee to receive a settlement payment.

March 2024 data leak and 2024 metadata theft; claim deadline December 18, 2025; final approval October 2, 2026.

Final approval moves the AT&T settlement toward payment, but dates depend on appeals and claim review. The underlying lessons concern third-party cloud accounts and old data.

After final approval, there is usually a period for appeals. Once that passes, the administrator validates claims, calculates pro rata amounts based on the fund and approved claims, and distributes payments. Delays are common when appeals are filed or claim volumes are large.

Only the court-appointed administrator's website and notices are authoritative for payment timing and amounts. News estimates are approximations based on fund size and claim rates.

The 2024 metadata theft was part of a wave of incidents involving stolen credentials for customer accounts on a third-party cloud data platform. Those incidents pushed many organisations to enforce MFA and network policies on their data platform accounts, controls that would have limited the damage.

The larger allocation to the incident involving Social Security numbers reflects the higher harm associated with identity data compared with metadata, as reflected in how the settlement divided the fund. Organisations assessing breach risk can use similar reasoning: the most sensitive identifiers drive the largest costs.

Inventory where customer identifiers and communication metadata live, including third-party platforms, enforce strong authentication on every account that can access them, and delete what you no longer need.

Payment timing had not been announced publicly at the time this was written; the administrator's site is the authoritative source.

Settlements over breaches involving third-party data platforms have become common since 2024. Comparing them shows how courts and parties value different data types, with identity data such as Social Security numbers typically valued far above contact details or metadata.

Check the administrator's site, and audit your own third-party data platform accounts.