Loading
Telecommunications
10 min read
Areas of Expertise :
Data Breach, Cybersecurity, Digital Forensics, Telecommunications, Class Action
Published Date:
Last Modified Date:
Jurisdiction:
Federal. Fifth Circuit
Lawsuits arising from two AT&T data incidents disclosed in 2024 initially followed separate procedural paths. Claims concerning the dataset announced on March 30, 2024, were centralized before Judge Ada E. Brown in the U.S. District Court for the Northern District of Texas as In re AT&T Inc. Customer Data Security Breach Litigation, MDL No. 3:24-md-03114-E. Claims concerning call and text interaction records disclosed on July 12, 2024, initially proceeded through In re Snowflake, Inc. Data Security Breach Litigation, MDL No. 3126, in the U.S. District Court for the District of Montana. The parties later filed a consolidated complaint and proposed a combined settlement before Judge Brown covering both groups of AT&T claims.
The plaintiffs alleged that AT&T failed to use adequate measures to protect customer information and asserted claims under federal statutes and common law. AT&T denied the allegations and agreed to the proposed settlement without admitting liability or wrongdoing. The agreement establishes two non-reversionary settlement funds totaling $177 million, with $149 million allocated to claims involving the first incident and $28 million allocated to claims involving the second. The court held a final approval hearing on January 15, 2026. As of July 15, 2026, the court had not entered an order granting or denying final approval.
AT&T announced that a dataset released on the dark web contained information associated with approximately 73 million current and former account holders. The records appeared to date from 2019 or earlier and contained different combinations of names, mailing addresses, telephone numbers, email addresses, dates of birth, account passcodes, billing account numbers, and Social Security numbers.
AT&T stated that it had not identified evidence showing that unauthorized access to its systems caused the dataset to be removed. The company also had not determined whether the information originated from AT&T or one of its vendors. AT&T reset account passcodes for affected current customers and began notifying people whose information appeared in the dataset.
Customers began filing proposed class actions in state and federal courts after the March disclosure. The complaints asserted negligence, breach of contract, privacy-related violations, and other claims arising from the alleged exposure of customer information.
The plaintiffs alleged that inadequate cybersecurity safeguards exposed them to identity theft and fraud and caused monitoring expenses and other losses. Similar federal cases were filed in several jurisdictions and became the subject of proceedings before the U.S. Judicial Panel on Multidistrict Litigation.
Threat actors copied files without authorization from an AT&T workspace hosted on Snowflake’s cloud platform between April 14 and April 25, 2024. AT&T learned of the activity on April 19 and began investigating with outside cybersecurity consultants and law enforcement agencies.
On May 9 and June 5, 2024, the U.S. Department of Justice determined that delaying public disclosure was warranted under federal cybersecurity-disclosure rules while investigative activity continued. The files involved telecommunications records that differed from the personal and account information addressed in the March disclosure.
The Judicial Panel on Multidistrict Litigation transferred related federal lawsuits involving the March disclosure to the U.S. District Court for the Northern District of Texas. The panel assigned the coordinated proceedings to Judge Ada E. Brown under the caption In re AT&T Inc. Customer Data Security Breach Litigation, MDL No. 3114.
The transfer placed common factual allegations, discovery issues, pretrial motions, and proposed class claims before one court. At that stage, the MDL covered claims arising from the dark-web dataset and did not include the separate telecommunications-records incident later disclosed in July.
AT&T announced that customer call and text interaction records had been copied without authorization from a third-party cloud environment. The affected data covered interactions occurring from approximately May 1 through October 31, 2022, and on January 2, 2023.
The files generally did not contain the content of calls or text messages, Social Security numbers, or dates of birth. They included telephone numbers, interaction counts, aggregate call durations, and, for some customers, cell-site identification information. The affected records covered nearly all AT&T wireless customers and customers of mobile virtual network operators using AT&T’s network during the identified periods.
The Judicial Panel on Multidistrict Litigation established In re Snowflake, Inc. Data Security Breach Litigation, MDL No. 3126, in the U.S. District Court for the District of Montana. The proceeding coordinated lawsuits involving incidents connected to Snowflake-hosted environments.
Claims arising from AT&T’s July disclosure initially became part of the Montana litigation because they concerned a different dataset and different alleged access activity from the March incident. The two groups of AT&T claims therefore proceeded in separate multidistrict cases during this stage.
The parties began discussing a possible combined settlement in December 2024. Following mediation, they agreed in March 2025 to pursue a resolution of the AT&T claims from both proceedings before Judge Brown in the Northern District of Texas.
The parties conducted confirmatory discovery and negotiated terms for two proposed settlement classes. AT&T continued to deny liability and wrongdoing throughout the negotiations.
The plaintiffs filed a consolidated complaint addressing both AT&T data incidents. The pleading asserted claims under the Communications Act, the Satellite Home Viewer Extension and Reauthorization Act, the Cable Television Consumer Protection and Competition Act, and common-law theories involving negligence, implied contract, and unjust enrichment.
The parties also submitted a proposed settlement agreement establishing two funds with a combined value of $177 million. AT&T agreed to the proposed resolution without admitting any legal violation, liability, or wrongdoing.
Judge Brown granted preliminary approval and provisionally certified two settlement classes corresponding to the March and July incidents. The order authorized a class notice program and established procedures for filing claims, requesting exclusion, and submitting objections.
The court also established administrative deadlines and scheduled a final approval hearing. Preliminary approval did not constitute a final judgment and did not authorize settlement payments.
The extended deadline for submitting settlement claim forms expired on December 18, 2025. Requests for exclusion and objections were due by November 17, 2025.
Claims submitted before the deadline remained subject to the agreement’s eligibility and documentation requirements. Settlement administration expenses, court-approved attorneys’ fees, litigation costs, service awards, and applicable taxes may be deducted from the fund assigned to each class.
The court conducted a final fairness hearing concerning the settlement on January 15, 2026. The hearing addressed the settlement terms, class notice, objections, requests for attorneys’ fees and costs, proposed service awards, and other approval issues.
As of July 15, 2026, the court had not issued an order granting or denying final approval. No settlement payment date had been announced.
Court:
United States District Court for the Northern District of Texas
Case Name:
In re AT&T Inc. Customer Data Security Breach Litigation
Information Security
Computer Security
Identity Theft
Cloud Services
Telecommunications Engineer
Online Privacy
Class Certification
Damages Calculations
Lawsuits arising from two AT&T data incidents disclosed in 2024 initially followed separate procedural paths. Claims concerning the dataset announced on March 30, 2024, were centralized before Judge Ada E. Brown in the U.S. District Court for the Northern District of Texas as In re AT&T Inc. Customer Data Security Breach Litigation, MDL No. 3:24-md-03114-E. Claims concerning call and text interaction records disclosed on July 12, 2024, initially proceeded through In re Snowflake, Inc. Data Security Breach Litigation, MDL No. 3126, in the U.S. District Court for the District of Montana. The parties later filed a consolidated complaint and proposed a combined settlement before Judge Brown covering both groups of AT&T claims.
The plaintiffs alleged that AT&T failed to use adequate measures to protect customer information and asserted claims under federal statutes and common law. AT&T denied the allegations and agreed to the proposed settlement without admitting liability or wrongdoing. The agreement establishes two non-reversionary settlement funds totaling $177 million, with $149 million allocated to claims involving the first incident and $28 million allocated to claims involving the second. The court held a final approval hearing on January 15, 2026. As of July 15, 2026, the court had not entered an order granting or denying final approval.
AT&T announced that a dataset released on the dark web contained information associated with approximately 73 million current and former account holders. The records appeared to date from 2019 or earlier and contained different combinations of names, mailing addresses, telephone numbers, email addresses, dates of birth, account passcodes, billing account numbers, and Social Security numbers.
AT&T stated that it had not identified evidence showing that unauthorized access to its systems caused the dataset to be removed. The company also had not determined whether the information originated from AT&T or one of its vendors. AT&T reset account passcodes for affected current customers and began notifying people whose information appeared in the dataset.
Customers began filing proposed class actions in state and federal courts after the March disclosure. The complaints asserted negligence, breach of contract, privacy-related violations, and other claims arising from the alleged exposure of customer information.
The plaintiffs alleged that inadequate cybersecurity safeguards exposed them to identity theft and fraud and caused monitoring expenses and other losses. Similar federal cases were filed in several jurisdictions and became the subject of proceedings before the U.S. Judicial Panel on Multidistrict Litigation.
Threat actors copied files without authorization from an AT&T workspace hosted on Snowflake’s cloud platform between April 14 and April 25, 2024. AT&T learned of the activity on April 19 and began investigating with outside cybersecurity consultants and law enforcement agencies.
On May 9 and June 5, 2024, the U.S. Department of Justice determined that delaying public disclosure was warranted under federal cybersecurity-disclosure rules while investigative activity continued. The files involved telecommunications records that differed from the personal and account information addressed in the March disclosure.
The Judicial Panel on Multidistrict Litigation transferred related federal lawsuits involving the March disclosure to the U.S. District Court for the Northern District of Texas. The panel assigned the coordinated proceedings to Judge Ada E. Brown under the caption In re AT&T Inc. Customer Data Security Breach Litigation, MDL No. 3114.
The transfer placed common factual allegations, discovery issues, pretrial motions, and proposed class claims before one court. At that stage, the MDL covered claims arising from the dark-web dataset and did not include the separate telecommunications-records incident later disclosed in July.
AT&T announced that customer call and text interaction records had been copied without authorization from a third-party cloud environment. The affected data covered interactions occurring from approximately May 1 through October 31, 2022, and on January 2, 2023.
The files generally did not contain the content of calls or text messages, Social Security numbers, or dates of birth. They included telephone numbers, interaction counts, aggregate call durations, and, for some customers, cell-site identification information. The affected records covered nearly all AT&T wireless customers and customers of mobile virtual network operators using AT&T’s network during the identified periods.
The Judicial Panel on Multidistrict Litigation established In re Snowflake, Inc. Data Security Breach Litigation, MDL No. 3126, in the U.S. District Court for the District of Montana. The proceeding coordinated lawsuits involving incidents connected to Snowflake-hosted environments.
Claims arising from AT&T’s July disclosure initially became part of the Montana litigation because they concerned a different dataset and different alleged access activity from the March incident. The two groups of AT&T claims therefore proceeded in separate multidistrict cases during this stage.
The parties began discussing a possible combined settlement in December 2024. Following mediation, they agreed in March 2025 to pursue a resolution of the AT&T claims from both proceedings before Judge Brown in the Northern District of Texas.
The parties conducted confirmatory discovery and negotiated terms for two proposed settlement classes. AT&T continued to deny liability and wrongdoing throughout the negotiations.
The plaintiffs filed a consolidated complaint addressing both AT&T data incidents. The pleading asserted claims under the Communications Act, the Satellite Home Viewer Extension and Reauthorization Act, the Cable Television Consumer Protection and Competition Act, and common-law theories involving negligence, implied contract, and unjust enrichment.
The parties also submitted a proposed settlement agreement establishing two funds with a combined value of $177 million. AT&T agreed to the proposed resolution without admitting any legal violation, liability, or wrongdoing.
Judge Brown granted preliminary approval and provisionally certified two settlement classes corresponding to the March and July incidents. The order authorized a class notice program and established procedures for filing claims, requesting exclusion, and submitting objections.
The court also established administrative deadlines and scheduled a final approval hearing. Preliminary approval did not constitute a final judgment and did not authorize settlement payments.
The extended deadline for submitting settlement claim forms expired on December 18, 2025. Requests for exclusion and objections were due by November 17, 2025.
Claims submitted before the deadline remained subject to the agreement’s eligibility and documentation requirements. Settlement administration expenses, court-approved attorneys’ fees, litigation costs, service awards, and applicable taxes may be deducted from the fund assigned to each class.
The court conducted a final fairness hearing concerning the settlement on January 15, 2026. The hearing addressed the settlement terms, class notice, objections, requests for attorneys’ fees and costs, proposed service awards, and other approval issues.
As of July 15, 2026, the court had not issued an order granting or denying final approval. No settlement payment date had been announced.
Cybersecurity and Data Protection Expert Witness
A cybersecurity controls expert may evaluate authentication systems, access restrictions, network monitoring, incident-response practices, and data-retention procedures. The testimony may address how the controls operated during the relevant period and whether available safeguards were implemented consistently.
Digital Forensics and Unauthorized Access Expert Witness
Digital forensic analysis may examine system logs, account activity, file-transfer records, access dates, credential use, and the sequence of events surrounding an alleged data removal. The findings may address which systems were accessed, what information was viewed or copied, and whether the available records support a proposed incident timeline.
Cloud Security and Third-Party Platform Expert Witness
A cloud security expert may review account permissions, multifactor authentication, credential management, logging, vendor oversight, and the allocation of security duties between a customer and a cloud platform. The analysis may distinguish controls supplied by the platform from controls that the customer was responsible for configuring or monitoring.
Telecommunications Records Expert Witness
A telecommunications records expert may explain call-detail records, interaction counts, aggregate call durations, wireless account structures, and cell-site identifiers. The testimony may also distinguish communications metadata from the content of calls and text messages.
Damages and Identity-Theft Expert Witness
A damages expert may evaluate claimed financial losses, fraud expenses, monitoring costs, mitigation expenses, and lost time. The analysis may examine whether claimed losses are supported by records and whether they can be connected to the incident alleged in the lawsuit.
Data Breach Expert Witness
A data breach expert witness may evaluate the overall circumstances of a security incident, including how information was accessed, the effectiveness of security practices, incident-response activities, and the scope of affected data. The testimony may also address whether the available technical evidence is consistent with the reported sequence of events and the issues raised in the litigation.
Two Non-Reversionary Settlement Funds
The proposed agreement creates a $149 million fund for the AT&T 1 class and a $28 million fund for the AT&T 2 class. The funds are administered separately rather than combined into one payment pool.
Each fund bears the deductions allocated to its class, including approved administration expenses, attorneys’ fees, litigation costs, service awards, and taxes.
Documented-Loss Claims
AT&T 1 class members could request up to $5,000 for qualifying documented losses incurred in 2019 or later. AT&T 2 class members could request up to $2,500 for qualifying documented losses incurred on or after April 14, 2024.
Claimants were required to provide the documentation required by the settlement. Submission of a claim did not guarantee approval or payment of the maximum amount.
Alternative Pro Rata Cash Benefits
Class members who did not seek documented-loss reimbursement could qualify for an alternative cash benefit where permitted by the agreement. The final amount depends on the number of approved claims and the money remaining in the applicable fund after authorized deductions and documented-loss payments.
For the AT&T 2 class, the Tier 3 pro rata payment was limited to qualifying account owners. AT&T 2 line users and end users who were not account owners remained eligible to submit qualifying documented-loss claims.
No Duplicate Recovery for the Same Loss
A claimant included in both classes could seek benefits under each class only when the claims were based on separate qualifying losses. The same receipt, expense, or alleged financial loss could not support payment from both funds.
Payments Require Final Approval
The claim period has closed, but settlement payments cannot begin unless the court grants final approval. Payment timing also may depend on the resolution of any appeals filed after the final approval order.
What Information Was Included in the March 2024 AT&T Dataset?
The dataset contained different combinations of names, mailing addresses, telephone numbers, email addresses, dates of birth, account passcodes, billing account numbers, and Social Security numbers. The information appeared to date from 2019 or earlier.
What Records Were Involved in the July 2024 AT&T Incident?
The files included telephone numbers, interaction counts, aggregate call durations, and some cell-site identification information. They generally did not contain the content of calls or text messages, Social Security numbers, or dates of birth.
Which MDLs Initially Handled the Two Groups of AT&T Claims?
Claims involving the March dataset were centralized in MDL No. 3114 in the Northern District of Texas. Claims involving the Snowflake-hosted telecommunications records initially proceeded through MDL No. 3126 in the District of Montana.
Could a Customer Belong to Both AT&T Settlement Classes?
Yes. A person may be included in both classes if AT&T identified that person as affected by both incidents. The same documented loss or supporting record could not be used to obtain payment from both funds.
Were the $5,000 and $2,500 Amounts Guaranteed Payments?
No. Those amounts are the maximum limits for qualifying documented-loss claims. Actual payments depend on eligibility, supporting records, available settlement funds, approved deductions, and the number of valid claims.
Cybersecurity and Data Protection Expert Witness
A cybersecurity controls expert may evaluate authentication systems, access restrictions, network monitoring, incident-response practices, and data-retention procedures. The testimony may address how the controls operated during the relevant period and whether available safeguards were implemented consistently.
Digital Forensics and Unauthorized Access Expert Witness
Digital forensic analysis may examine system logs, account activity, file-transfer records, access dates, credential use, and the sequence of events surrounding an alleged data removal. The findings may address which systems were accessed, what information was viewed or copied, and whether the available records support a proposed incident timeline.
Cloud Security and Third-Party Platform Expert Witness
A cloud security expert may review account permissions, multifactor authentication, credential management, logging, vendor oversight, and the allocation of security duties between a customer and a cloud platform. The analysis may distinguish controls supplied by the platform from controls that the customer was responsible for configuring or monitoring.
Telecommunications Records Expert Witness
A telecommunications records expert may explain call-detail records, interaction counts, aggregate call durations, wireless account structures, and cell-site identifiers. The testimony may also distinguish communications metadata from the content of calls and text messages.
Damages and Identity-Theft Expert Witness
A damages expert may evaluate claimed financial losses, fraud expenses, monitoring costs, mitigation expenses, and lost time. The analysis may examine whether claimed losses are supported by records and whether they can be connected to the incident alleged in the lawsuit.
Data Breach Expert Witness
A data breach expert witness may evaluate the overall circumstances of a security incident, including how information was accessed, the effectiveness of security practices, incident-response activities, and the scope of affected data. The testimony may also address whether the available technical evidence is consistent with the reported sequence of events and the issues raised in the litigation.
Two Non-Reversionary Settlement Funds
The proposed agreement creates a $149 million fund for the AT&T 1 class and a $28 million fund for the AT&T 2 class. The funds are administered separately rather than combined into one payment pool.
Each fund bears the deductions allocated to its class, including approved administration expenses, attorneys’ fees, litigation costs, service awards, and taxes.
Documented-Loss Claims
AT&T 1 class members could request up to $5,000 for qualifying documented losses incurred in 2019 or later. AT&T 2 class members could request up to $2,500 for qualifying documented losses incurred on or after April 14, 2024.
Claimants were required to provide the documentation required by the settlement. Submission of a claim did not guarantee approval or payment of the maximum amount.
Alternative Pro Rata Cash Benefits
Class members who did not seek documented-loss reimbursement could qualify for an alternative cash benefit where permitted by the agreement. The final amount depends on the number of approved claims and the money remaining in the applicable fund after authorized deductions and documented-loss payments.
For the AT&T 2 class, the Tier 3 pro rata payment was limited to qualifying account owners. AT&T 2 line users and end users who were not account owners remained eligible to submit qualifying documented-loss claims.
No Duplicate Recovery for the Same Loss
A claimant included in both classes could seek benefits under each class only when the claims were based on separate qualifying losses. The same receipt, expense, or alleged financial loss could not support payment from both funds.
Payments Require Final Approval
The claim period has closed, but settlement payments cannot begin unless the court grants final approval. Payment timing also may depend on the resolution of any appeals filed after the final approval order.
What Information Was Included in the March 2024 AT&T Dataset?
The dataset contained different combinations of names, mailing addresses, telephone numbers, email addresses, dates of birth, account passcodes, billing account numbers, and Social Security numbers. The information appeared to date from 2019 or earlier.
What Records Were Involved in the July 2024 AT&T Incident?
The files included telephone numbers, interaction counts, aggregate call durations, and some cell-site identification information. They generally did not contain the content of calls or text messages, Social Security numbers, or dates of birth.
Which MDLs Initially Handled the Two Groups of AT&T Claims?
Claims involving the March dataset were centralized in MDL No. 3114 in the Northern District of Texas. Claims involving the Snowflake-hosted telecommunications records initially proceeded through MDL No. 3126 in the District of Montana.
Could a Customer Belong to Both AT&T Settlement Classes?
Yes. A person may be included in both classes if AT&T identified that person as affected by both incidents. The same documented loss or supporting record could not be used to obtain payment from both funds.
Were the $5,000 and $2,500 Amounts Guaranteed Payments?
No. Those amounts are the maximum limits for qualifying documented-loss claims. Actual payments depend on eligibility, supporting records, available settlement funds, approved deductions, and the number of valid claims.
Information Security
Computer Security
Identity Theft
Cloud Services
Telecommunications Engineer
Online Privacy
Class Certification
Damages Calculations
Cybersecurity, +4
Telecommunications
Trade Secret, +3
Telecommunications