AT&T Is Paying Out Its $177 Million Data Breach Settlement. You Might Get a Check Soon

Over 110 million AT&T customers had their personal information stolen in two high-profile data breaches during 2019 and 2024. The cybersecurity incidents exposed sensitive data, prompting consumers to seek compensation through a class-action lawsuit. The lawsuit (PDF) alleged that AT&T didn’t do enough to protect customer data or to promptly notify them of the data breaches. While the company didn’t admit to any wrongdoing, it agreed to pay $177 million in restitution to the settlement class. The deadline to file a claim was last December, but these settlement transactions take a long time to process. Money must be divided to cover administrative and legal fees. Information must also be disseminated to as many eligible settlement class members as possible. More than 4.9 million eligible customers filed a claim, and you may be one of them. Though AT&T can still appeal the court’s decision until Nov. 2, if no appeal is made, the court has 10 days to issue a final approval for the settlement. The payouts would then be issued electronically or by mail within 60 days of that final approval (PDF), meaning claimants could potentially receive their settlement money by early 2027. How much money can you expect from the AT&T settlement? If you filed a valid claim as part of the AT&T data breach settlement and provided documentation of financial losses, you could be eligible to receive up to $7,500, depending on the settlement class you’re a part of (PDF). Here’s how that breaks down. 2019 breach: As part of the AT&T 1 Data Incident settlement class, anyone whose Social Security number was stolen and who can prove they suffered financial losses from the hack is eligible for up to a $5,000 check. 2024 breach: As part of the AT&T 2 Data Incident settlement class, anyone who proved they suffered financial loss in relation to this hack is eligible for up to a $2,500 check. Customers who could prove they were affected by the AT&T 1 and AT&T 2 breaches are eligible for up to a $7,500 check, provided they have documentation for both breaches. However, the vast bulk of eligible claimants — more than 3.7 million — who did not include any documentation of losses with their claim forms will get drastically lower payouts in what’s called a tiered distribution system. The tiered cash payments are far below the settlement’s advertised maximums, ranging from $6.50 to $40. These claims will be paid out “pro rata,” meaning the money will be distributed evenly based on what’s left in the total settlement allotment. All payout amounts are estimates and not guaranteed. If you filed a claim and want more information or updates, you can contact the settlement administrator on the website telecomdatasettlement.com or by calling 833-890-4930. The hackers behind the 2024 AT&T hack are closely associated with the infamous ShinyHunters group.Timon Schneider/SOPA Images/LightRocket/Getty Images What happened during the 2019 and 2024 data breaches? AT&T suffered two major data breaches in 2019 and 2024, with customers’ personal information appearing on the dark web after the latter incident. The company did not publicly acknowledge the hack for several weeks after the leaked data began proliferating online. The 2019 hack affected 65.4 million former customers and 7.6 million active account holders, exposing extremely sensitive information including Social Security numbers, birth dates and full legal names. The leaked information was important and wide-ranging enough that AT&T took the drastic measure of resetting the passwords of every affected customer. The 2024 breach was broader in scope, impacting nearly 109 million wireless customers, but the information wasn’t as sensitive. During this hack, call and text records, timestamps and cell tower location data that AT&T had saved from 2022 were illegally accessed. (Because nearly all 73 million people from the first breach were also part of the broader 110 million pool in the second breach, the total number of customers affected is capped at around 110 million.) Hackers from the UNC5537 group claimed responsibility for the 2024 breach, part of a larger hacking spree targeting the Snowflake databases of more than 160 companies. UNC5537is a close affiliate of ShinyHunters, a notorious hacker group that frequently targets corporations with large stores of customer information. Two individuals were arrested in connection with the case. While the exploits used in 2024 have been thoroughly documented and patched, hackers continue to target Snowflake servers through third-party partners, as seen in the recent Rockstar server hack.