AT&T Data Breach Settlement Sets Payouts Up to 5,000

Two AT&T data breaches lead to a $177 million settlement with potential payouts for affected customers and clear filing deadlines.

AT&T Data Breach Settlement Sets Payouts Up to 5,000

AT&T has secured preliminary approval for a $177 million class action settlement tied to two data breaches, one in 2019 and another in 2024. The settlement designates $149 million to address the 2019 incident, which affected current and former subscribers and exposed names, Social Security numbers, and dates of birth for many customers. A separate $28 million addresses the 2024 breach tied to Snowflake, where access to call and text records was reported.

Eligible customers can file by November 18, 2025 to receive one of two payouts. Those with documented monetary losses from the 2019 breach can claim up to $5,000; otherwise, participants can take part in the class payout, with amounts determined by the number of claimants and which data was exposed. For the 2024 breach, the maximum for documented losses is $2,500. To file, claimants need a class member ID and one of several identifiers on the settlement site; if the ID is missing, they can contact the administrator. Opting out by October 17, 2025 preserves the right to sue separately, and a final settlement hearing is scheduled for December 3, 2025. AT&T, in a statement, says it denies the allegations but settled to avoid the expense and uncertainty of protracted litigation and to protect customer data.

The payout structure shows a path to relief, but the amounts may not fully compensate all victims. The 2019 payout allows up to 5,000 for documented losses, while the 2024 payout tops out at 2,500, with broader class payments depending on how many claims are filed. That design places emphasis on documenting losses and the practical reach of the settlement for millions of affected customers.

Beyond money, the case highlights how private settlements shape corporate accountability. While the process offers a quick path to some remedy and closure, it can also dampen the impetus for lasting security upgrades if public scrutiny shifts elsewhere. Regulators and privacy advocates will watch how AT&T implements stronger protections and whether future breaches trigger stiffer, independent safeguards rather than private settlements.

Highlights

The settlement underscores how private deals shape data protection expectations and future corporate behavior.