Loading
Telecommunications
7 min read
Areas of Expertise :
Cybersecurity, Digital Forensics, Data Breach, Data Security, Data Privacy
Published Date:
Last Modified Date:
Jurisdiction:
Federal. Eighth Circuit
The 2021 T-Mobile data breach led to consolidated federal litigation over the exposure of personal information associated with approximately 76.6 million current, former, and prospective customers and other individuals. Unauthorized access to portions of T-Mobile's systems began around March 18, 2021, and customer information was accessed and taken beginning around August 3. The compromised data varied by individual and included names, dates of birth, addresses, Social Security numbers, driver's license information, phone numbers, and certain mobile-device identifiers.
Consumers later filed lawsuits alleging that T-Mobile had not adequately protected their personally identifiable information. The consolidated claims identified several disputed cybersecurity measures, including firewall configuration, network segmentation, credential security, activity monitoring, data-loss prevention, and intrusion detection and prevention. The federal actions were centralized in the U.S. District Court for the Western District of Missouri and ultimately resolved through a $350 million class settlement, together with a separate $150 million commitment for additional data-security and technology spending. Because the litigation settled before the cybersecurity claims were adjudicated on the merits, those allegations did not result in a judicial finding that T-Mobile's security controls were legally deficient.
Unauthorized access to certain areas of T-Mobile's systems began on or about March 18, 2021. Customer information was accessed and taken beginning around August 3. On August 15, reports emerged that information associated with T-Mobile customers was being offered for sale online. T-Mobile confirmed on August 16 that unauthorized access to some company data had occurred and confirmed on August 17 that stolen files included personal information belonging to current, former, and prospective customers.
The information involved differed among affected individuals. Categories included names, dates of birth, addresses, Social Security numbers, driver's license information, phone numbers, and certain mobile-device identifiers.
Consumers filed proposed class actions in several federal courts after the breach became public. On December 3, 2021, the U.S. Judicial Panel on Multidistrict Litigation centralized the federal cases in the Western District of Missouri under In re T-Mobile Customer Data Security Breach Litigation, MDL No. 3019.
At that time, five actions were pending in four federal districts, with 39 additional related actions filed in nine districts. U.S. District Judge Brian C. Wimes was assigned to oversee the coordinated pretrial proceedings.
Plaintiffs filed a consolidated consumer class-action complaint on May 11, 2022. The complaint alleged deficiencies involving firewall configuration, network segmentation, secure credential storage, rate limiting, user-activity monitoring, data-loss prevention, and intrusion detection and prevention.
Settlement discussions began during the early stages of the consolidated litigation. The parties participated in mediation on June 7 and 8, 2022, and reached a settlement in principle. As a result, the case moved toward negotiated resolution before the negligence and cybersecurity claims were decided on the merits.
The parties executed a class-action settlement agreement on July 22, 2022. T-Mobile agreed to establish a $350 million settlement fund for eligible class claims, settlement administration, attorneys' fees, and related expenses. The company also committed to spend an additional $150 million on data security and related technology during 2022 and 2023.
Judge Wimes granted preliminary approval on July 26 under Federal Rule of Civil Procedure 23. The agreement resolved the claims without an admission of liability, wrongdoing, or responsibility.
The district court held a final approval hearing on January 20, 2023. The settlement class covered approximately 76.6 million U.S. residents whose information had been identified as compromised in the 2021 breach.
On June 29, 2023, the court granted final approval and addressed attorneys' fees, litigation expenses, and service awards for the class representatives. The settlement resolved the underlying consumer claims, while disputes concerning the attorneys' fee award later proceeded to the U.S. Court of Appeals for the Eighth Circuit.
Two class members challenged the district court's handling of settlement objections and its $78.75 million attorneys' fee award. On July 29, 2024, the Eighth Circuit reversed the fee award and returned the issue to the district court for reconsideration. That appeal focused on settlement procedure and attorneys' fees rather than the merits of the cybersecurity allegations.
Class counsel submitted a revised fee request on September 10, 2024, and the district court granted the revised motion on January 16, 2025. A later appeal filed in September 2025 was dismissed by the Eighth Circuit for lack of jurisdiction in November 2025. Rehearing was denied in January 2026, and the mandate followed later that month. The required settlement payment and additional security expenditures were completed, and distributions to eligible class members began in May 2025.
Court:
United States District Court for the Western District of Missouri, Western Division
Case Name:
In re T-Mobile Customer Data Security Breach Litigation
The 2021 T-Mobile breach exposed personal information associated with approximately 76.6 million current, former, and prospective customers and other individuals.
The litigation focused on alleged deficiencies in cybersecurity controls, including firewalls, network segmentation, credential security, monitoring, and intrusion detection.
Federal lawsuits were centralized in the Western District of Missouri as multidistrict litigation.
T-Mobile agreed to a $350 million class settlement and a separate $150 million commitment for additional data-security and technology spending.
The case settled without a judicial finding that T-Mobile’s cybersecurity controls were legally deficient.
Computer Security
Information Security
Firewalls
Network Architecture
Internet Security
Identity Theft
Electronic Authentication
The 2021 T-Mobile data breach led to consolidated federal litigation over the exposure of personal information associated with approximately 76.6 million current, former, and prospective customers and other individuals. Unauthorized access to portions of T-Mobile's systems began around March 18, 2021, and customer information was accessed and taken beginning around August 3. The compromised data varied by individual and included names, dates of birth, addresses, Social Security numbers, driver's license information, phone numbers, and certain mobile-device identifiers.
Consumers later filed lawsuits alleging that T-Mobile had not adequately protected their personally identifiable information. The consolidated claims identified several disputed cybersecurity measures, including firewall configuration, network segmentation, credential security, activity monitoring, data-loss prevention, and intrusion detection and prevention. The federal actions were centralized in the U.S. District Court for the Western District of Missouri and ultimately resolved through a $350 million class settlement, together with a separate $150 million commitment for additional data-security and technology spending. Because the litigation settled before the cybersecurity claims were adjudicated on the merits, those allegations did not result in a judicial finding that T-Mobile's security controls were legally deficient.
Unauthorized access to certain areas of T-Mobile's systems began on or about March 18, 2021. Customer information was accessed and taken beginning around August 3. On August 15, reports emerged that information associated with T-Mobile customers was being offered for sale online. T-Mobile confirmed on August 16 that unauthorized access to some company data had occurred and confirmed on August 17 that stolen files included personal information belonging to current, former, and prospective customers.
The information involved differed among affected individuals. Categories included names, dates of birth, addresses, Social Security numbers, driver's license information, phone numbers, and certain mobile-device identifiers.
Consumers filed proposed class actions in several federal courts after the breach became public. On December 3, 2021, the U.S. Judicial Panel on Multidistrict Litigation centralized the federal cases in the Western District of Missouri under In re T-Mobile Customer Data Security Breach Litigation, MDL No. 3019.
At that time, five actions were pending in four federal districts, with 39 additional related actions filed in nine districts. U.S. District Judge Brian C. Wimes was assigned to oversee the coordinated pretrial proceedings.
Plaintiffs filed a consolidated consumer class-action complaint on May 11, 2022. The complaint alleged deficiencies involving firewall configuration, network segmentation, secure credential storage, rate limiting, user-activity monitoring, data-loss prevention, and intrusion detection and prevention.
Settlement discussions began during the early stages of the consolidated litigation. The parties participated in mediation on June 7 and 8, 2022, and reached a settlement in principle. As a result, the case moved toward negotiated resolution before the negligence and cybersecurity claims were decided on the merits.
The parties executed a class-action settlement agreement on July 22, 2022. T-Mobile agreed to establish a $350 million settlement fund for eligible class claims, settlement administration, attorneys' fees, and related expenses. The company also committed to spend an additional $150 million on data security and related technology during 2022 and 2023.
Judge Wimes granted preliminary approval on July 26 under Federal Rule of Civil Procedure 23. The agreement resolved the claims without an admission of liability, wrongdoing, or responsibility.
The district court held a final approval hearing on January 20, 2023. The settlement class covered approximately 76.6 million U.S. residents whose information had been identified as compromised in the 2021 breach.
On June 29, 2023, the court granted final approval and addressed attorneys' fees, litigation expenses, and service awards for the class representatives. The settlement resolved the underlying consumer claims, while disputes concerning the attorneys' fee award later proceeded to the U.S. Court of Appeals for the Eighth Circuit.
Two class members challenged the district court's handling of settlement objections and its $78.75 million attorneys' fee award. On July 29, 2024, the Eighth Circuit reversed the fee award and returned the issue to the district court for reconsideration. That appeal focused on settlement procedure and attorneys' fees rather than the merits of the cybersecurity allegations.
Class counsel submitted a revised fee request on September 10, 2024, and the district court granted the revised motion on January 16, 2025. A later appeal filed in September 2025 was dismissed by the Eighth Circuit for lack of jurisdiction in November 2025. Rehearing was denied in January 2026, and the mandate followed later that month. The required settlement payment and additional security expenditures were completed, and distributions to eligible class members began in May 2025.
Because the litigation settled before trial, the cybersecurity allegations were not resolved through a merits ruling or trial verdict. The claims nevertheless identify several technical areas that can require expert analysis in data-breach disputes, particularly where parties disagree about how security controls were configured, how unauthorized activity occurred, what information was affected, and how claimed losses should be evaluated.
Cybersecurity Expert Witness
The allegations concerning firewall configuration, network segmentation, credential security, and access controls are the types of issues a cybersecurity expert may evaluate. Relevant analysis can include network architecture, firewall settings, authentication controls, credential-management practices, segmentation, monitoring systems, and intrusion-detection measures.
That work may also compare the controls in place during the relevant period with internal policies, recognized cybersecurity practices, and the technical design of the affected environment. In a dispute such as this one, the expert's role is to explain how the controls operated and whether the available technical evidence supports the positions advanced by the parties.
Digital Forensics and Incident Response Expert Witness
The breach timeline and allegations concerning unauthorized access can also raise digital-forensics and incident-response questions. Relevant evidence may include authentication records, system logs, network traffic, forensic images, security alerts, and other electronic records generated before, during, and after the intrusion.
An expert reviewing that evidence may reconstruct the sequence of unauthorized activity, trace movement through affected systems, identify information that was accessed or taken, and document when detection and containment activity occurred.
Data Privacy and Information Governance Expert Witness
The litigation also involved personal information stored across T-Mobile's systems, making data handling and governance relevant areas of technical review. Analysis can address how personal information was collected, classified, stored, retained, and made accessible within an organization.
Data inventories, retention practices, access permissions, information-classification systems, and controls governing sensitive customer records may help explain where information was maintained and how access to that information was managed.
Economic Damages and Identity Theft Expert Witness
Claims arising from a data breach can also involve alleged financial harm. An economic damages expert may evaluate losses related to fraudulent transactions, identity theft, credit monitoring, remediation expenses, or time spent responding to a breach.
The analysis may distinguish documented financial losses from projected risks and assess the methodology used to calculate individual or class-wide damages.
Firewall Configuration, Network Segmentation, and Access Controls
Plaintiffs specifically challenged parts of T-Mobile's cybersecurity environment, including firewall configuration, network segmentation, credential storage, rate limiting, and controls governing access to systems containing personal information. These allegations focused on how access to sensitive systems and data was restricted before the breach.
Review of those issues may involve network diagrams, firewall rules, authentication systems, administrative privileges, configuration histories, and access records. Together, those materials can help establish how systems were separated, which users or accounts could reach sensitive data, and how access restrictions were configured during the relevant period.
Security Monitoring and Intrusion Detection
The consolidated claims also addressed user-activity monitoring, data-loss prevention, and intrusion detection and prevention. These controls are intended to identify unusual activity, detect unauthorized access, monitor movement of sensitive information, and generate alerts when defined security conditions occur.
Evidence such as security alerts, event logs, network telemetry, authentication histories, endpoint records, and security-information and event-management data may show how activity developed within an affected environment. That evidence can also help document the sequence of detection and response.
Personal Information Compromised in the Breach
The information exposed in the 2021 breach varied among affected individuals. Categories included names, addresses, dates of birth, Social Security numbers, driver's license information, phone numbers, and certain mobile-device identifiers.
Because different categories of personal information may be stored in separate systems or governed by different access and retention controls, technical review may focus on where particular data was stored, which systems were accessed, and what information was taken.
Multidistrict Litigation and Consolidation of the Federal Claims
The T-Mobile lawsuits proceeded through federal multidistrict litigation after related actions were filed in several jurisdictions. The Judicial Panel on Multidistrict Litigation transferred the cases to the Western District of Missouri for coordinated pretrial proceedings under MDL No. 3019.
Centralization allowed common discovery, motions, class issues, and settlement matters to be handled before one federal judge. Judge Brian C. Wimes presided over the consolidated litigation.
Settlement Terms and Data-Security Spending
The settlement resolved the consumer claims through two separate financial components. T-Mobile agreed to fund $350 million for eligible class claims, settlement administration, attorneys' fees, and related expenses, while also committing an additional $150 million for data security and related technology during 2022 and 2023.
These obligations resolved the litigation without a trial verdict on the underlying cybersecurity claims. The settlement therefore established financial and operational commitments without producing a judicial determination that the alleged security deficiencies had been proven.
In re T-Mobile Customer Data Security Breach Litigation ended through a negotiated class settlement after federal actions arising from the 2021 cyberattack were centralized in the Western District of Missouri. The litigation placed several cybersecurity issues in dispute, including network security, access controls, credential practices, monitoring, intrusion detection, and the protection of personal information, but those allegations were not adjudicated through a trial judgment.
The district court granted final settlement approval in June 2023. The Eighth Circuit later reversed and remanded the attorneys' fee award in July 2024, after which the district court approved a revised fee request in January 2025. A later appeal was dismissed for lack of jurisdiction, and settlement distributions began in May 2025. The case therefore concluded with settlement and subsequent fee-related appellate proceedings rather than a merits ruling on T-Mobile's cybersecurity liability.
When did the 2021 T-Mobile data breach occur?
Unauthorized access to certain parts of T-Mobile's systems began around March 18, 2021. Customer data was accessed and taken beginning around August 3. T-Mobile confirmed unauthorized access on August 16 and confirmed on August 17 that stolen files included personal information.
How many people were included in the T-Mobile data breach settlement?
The settlement class covered approximately 76.6 million U.S. residents whose information had been identified as compromised in the 2021 breach.
Was T-Mobile found liable for the data breach?
No. The litigation ended through a class settlement before a court or jury entered a judgment finding T-Mobile liable for the cyberattack.
How much was the T-Mobile data breach settlement?
The settlement created a $350 million fund for eligible class claims, settlement administration, attorneys' fees, and related expenses. T-Mobile separately committed to $150 million in additional data-security and technology spending during 2022 and 2023.
What can a cybersecurity expert analyze in a data-breach lawsuit?
A cybersecurity expert may examine network architecture, firewall configuration, access controls, credential security, network segmentation, monitoring systems, and incident-response measures. Digital forensics experts may also analyze logs, authentication records, network activity, and other electronic evidence to reconstruct an intrusion and response timeline.
Because the litigation settled before trial, the cybersecurity allegations were not resolved through a merits ruling or trial verdict. The claims nevertheless identify several technical areas that can require expert analysis in data-breach disputes, particularly where parties disagree about how security controls were configured, how unauthorized activity occurred, what information was affected, and how claimed losses should be evaluated.
Cybersecurity Expert Witness
The allegations concerning firewall configuration, network segmentation, credential security, and access controls are the types of issues a cybersecurity expert may evaluate. Relevant analysis can include network architecture, firewall settings, authentication controls, credential-management practices, segmentation, monitoring systems, and intrusion-detection measures.
That work may also compare the controls in place during the relevant period with internal policies, recognized cybersecurity practices, and the technical design of the affected environment. In a dispute such as this one, the expert's role is to explain how the controls operated and whether the available technical evidence supports the positions advanced by the parties.
Digital Forensics and Incident Response Expert Witness
The breach timeline and allegations concerning unauthorized access can also raise digital-forensics and incident-response questions. Relevant evidence may include authentication records, system logs, network traffic, forensic images, security alerts, and other electronic records generated before, during, and after the intrusion.
An expert reviewing that evidence may reconstruct the sequence of unauthorized activity, trace movement through affected systems, identify information that was accessed or taken, and document when detection and containment activity occurred.
Data Privacy and Information Governance Expert Witness
The litigation also involved personal information stored across T-Mobile's systems, making data handling and governance relevant areas of technical review. Analysis can address how personal information was collected, classified, stored, retained, and made accessible within an organization.
Data inventories, retention practices, access permissions, information-classification systems, and controls governing sensitive customer records may help explain where information was maintained and how access to that information was managed.
Economic Damages and Identity Theft Expert Witness
Claims arising from a data breach can also involve alleged financial harm. An economic damages expert may evaluate losses related to fraudulent transactions, identity theft, credit monitoring, remediation expenses, or time spent responding to a breach.
The analysis may distinguish documented financial losses from projected risks and assess the methodology used to calculate individual or class-wide damages.
Firewall Configuration, Network Segmentation, and Access Controls
Plaintiffs specifically challenged parts of T-Mobile's cybersecurity environment, including firewall configuration, network segmentation, credential storage, rate limiting, and controls governing access to systems containing personal information. These allegations focused on how access to sensitive systems and data was restricted before the breach.
Review of those issues may involve network diagrams, firewall rules, authentication systems, administrative privileges, configuration histories, and access records. Together, those materials can help establish how systems were separated, which users or accounts could reach sensitive data, and how access restrictions were configured during the relevant period.
Security Monitoring and Intrusion Detection
The consolidated claims also addressed user-activity monitoring, data-loss prevention, and intrusion detection and prevention. These controls are intended to identify unusual activity, detect unauthorized access, monitor movement of sensitive information, and generate alerts when defined security conditions occur.
Evidence such as security alerts, event logs, network telemetry, authentication histories, endpoint records, and security-information and event-management data may show how activity developed within an affected environment. That evidence can also help document the sequence of detection and response.
Personal Information Compromised in the Breach
The information exposed in the 2021 breach varied among affected individuals. Categories included names, addresses, dates of birth, Social Security numbers, driver's license information, phone numbers, and certain mobile-device identifiers.
Because different categories of personal information may be stored in separate systems or governed by different access and retention controls, technical review may focus on where particular data was stored, which systems were accessed, and what information was taken.
Multidistrict Litigation and Consolidation of the Federal Claims
The T-Mobile lawsuits proceeded through federal multidistrict litigation after related actions were filed in several jurisdictions. The Judicial Panel on Multidistrict Litigation transferred the cases to the Western District of Missouri for coordinated pretrial proceedings under MDL No. 3019.
Centralization allowed common discovery, motions, class issues, and settlement matters to be handled before one federal judge. Judge Brian C. Wimes presided over the consolidated litigation.
Settlement Terms and Data-Security Spending
The settlement resolved the consumer claims through two separate financial components. T-Mobile agreed to fund $350 million for eligible class claims, settlement administration, attorneys' fees, and related expenses, while also committing an additional $150 million for data security and related technology during 2022 and 2023.
These obligations resolved the litigation without a trial verdict on the underlying cybersecurity claims. The settlement therefore established financial and operational commitments without producing a judicial determination that the alleged security deficiencies had been proven.
In re T-Mobile Customer Data Security Breach Litigation ended through a negotiated class settlement after federal actions arising from the 2021 cyberattack were centralized in the Western District of Missouri. The litigation placed several cybersecurity issues in dispute, including network security, access controls, credential practices, monitoring, intrusion detection, and the protection of personal information, but those allegations were not adjudicated through a trial judgment.
The district court granted final settlement approval in June 2023. The Eighth Circuit later reversed and remanded the attorneys' fee award in July 2024, after which the district court approved a revised fee request in January 2025. A later appeal was dismissed for lack of jurisdiction, and settlement distributions began in May 2025. The case therefore concluded with settlement and subsequent fee-related appellate proceedings rather than a merits ruling on T-Mobile's cybersecurity liability.
When did the 2021 T-Mobile data breach occur?
Unauthorized access to certain parts of T-Mobile's systems began around March 18, 2021. Customer data was accessed and taken beginning around August 3. T-Mobile confirmed unauthorized access on August 16 and confirmed on August 17 that stolen files included personal information.
How many people were included in the T-Mobile data breach settlement?
The settlement class covered approximately 76.6 million U.S. residents whose information had been identified as compromised in the 2021 breach.
Was T-Mobile found liable for the data breach?
No. The litigation ended through a class settlement before a court or jury entered a judgment finding T-Mobile liable for the cyberattack.
How much was the T-Mobile data breach settlement?
The settlement created a $350 million fund for eligible class claims, settlement administration, attorneys' fees, and related expenses. T-Mobile separately committed to $150 million in additional data-security and technology spending during 2022 and 2023.
What can a cybersecurity expert analyze in a data-breach lawsuit?
A cybersecurity expert may examine network architecture, firewall configuration, access controls, credential security, network segmentation, monitoring systems, and incident-response measures. Digital forensics experts may also analyze logs, authentication records, network activity, and other electronic evidence to reconstruct an intrusion and response timeline.
Computer Security
Information Security
Firewalls
Network Architecture
Internet Security
Identity Theft
Electronic Authentication
Trade Secret, +3
Telecommunications
Patent, +4
Telecommunications