What Is the AT&T Lawsuit?
The AT&T lawsuit is a consolidated federal class action against AT&T Inc. and AT&T Mobility over two separate 2024 data security incidents, not a single unconsolidated case. It is formally captioned In re: AT&T Inc. Customer Data Security Breach Litigation, MDL Docket No. 3:24-md-03114-E, pending before the U.S. District Court for the Northern District of Texas, Dallas Division.
Numerous individual lawsuits filed across federal and state courts after AT&T disclosed two data incidents in 2024 were consolidated into this single action for pretrial purposes. Plaintiffs allege AT&T repeatedly failed to adequately protect customer data, first in a dark-web data leak disclosed in March 2024 and again in a separate breach disclosed in July 2024 involving a third-party cloud platform.
AT&T Inc. and AT&T Mobility are the named defendants. The company has denied any wrongdoing or liability in both incidents while agreeing to resolve the consolidated litigation through the settlement described on this page.
“This Action is a putative class action before this Court. The Settlement provides for two non-reversionary Settlement Funds consisting of: (a) $149,000,000 in cash for the benefit of the AT&T 1 Settlement Class; and (b) $28,000,000 in cash for the benefit of the AT&T 2 Settlement Class.”
Source: In re: AT&T Inc. Customer Data Security Breach Litigation, MDL Docket No. 3:24-md-03114-E, Case No. 3:24-cv-00757-E, Preliminary Approval Order, Document 298, at 1, 6 (N.D. Tex. Dallas Div. June 20, 2025)
Why Are People Filing AT&T Lawsuits?
People filed AT&T lawsuits because AT&T is alleged to have repeatedly failed to protect customer data across two separate 2024 security incidents, exposing personal information and call records to unauthorized access. Plaintiffs in the consolidated action argue that a company handling this volume of sensitive customer data owed a duty of reasonable care it did not meet on either occasion.
The first incident, referred to in the litigation as AT&T 1, involved a dataset containing personal information on roughly 73 million current and former customers that surfaced for sale on a dark-web hacking forum, with data reportedly dating back to 2019 or earlier. AT&T initially denied the information came from its own systems before confirming the incident in March 2024.
The second incident, AT&T 2, involved an unauthorized user downloading customer call and text metadata from a workspace AT&T hosted on a third-party cloud platform, an incident AT&T disclosed in July 2024 and linked to a broader wave of attacks against that cloud provider's customers. AT&T has said in public statements that it agreed to settle "to avoid the expense and uncertainty of protracted litigation" rather than to concede the allegations.
What Injuries Are Included in the AT&T Lawsuit?
The AT&T lawsuit alleges two distinct data security incidents, each with its own settlement class. Each is defined in plain language below, followed by what plaintiffs specifically allege. AT&T has not been found liable in either matter and has denied wrongdoing.
The AT&T 1 Dark-Web Data Incident
A dark-web data leak is the unauthorized appearance of stolen personal information for sale or free distribution on forums only accessible through specialized software, typically evidence that a company's systems or a vendor's systems were previously compromised.
Plaintiffs allege a dataset containing personal information for approximately 7.6 million current and 65.4 million former AT&T account holders, roughly 73 million people combined, was found circulating on a dark-web hacking forum beginning as early as 2021, with the underlying data reportedly originating from 2019 or earlier. The complaint alleges the exposed information included names, addresses, phone numbers, email addresses, dates of birth, and in some cases Social Security numbers and account passcodes.
The AT&T 2 Cloud Platform Data Incident
A cloud-platform data incident is unauthorized access to data a company stores with a third-party cloud service provider, distinct from a direct intrusion into the company's own internal systems.
Plaintiffs allege an unauthorized user illegally downloaded call and text interaction records for what AT&T described as "nearly all" of its cellular customers from a workspace AT&T hosted on a third-party cloud platform, an incident AT&T disclosed in July 2024. The complaint alleges the exposed records included telephone numbers customers called or texted and the frequency of those interactions, though AT&T has stated the content of the calls and texts themselves was not exposed.
Who Qualifies for the AT&T Lawsuit?
You may qualify if:
- You are a living person in the United States whose personal information was included in the AT&T 1 dark-web data incident announced March 30, 2024 (the AT&T 1 Settlement Class)
- You were an AT&T account owner, line user, or end user whose call or text records were involved in the AT&T 2 cloud-platform data incident announced July 12, 2024 (the AT&T 2 Settlement Class)
- You submitted a valid claim form before the December 18, 2025 deadline for the settlement class or classes that applied to you
You may not qualify if:
- AT&T, its officers, directors, or the presiding judge and their immediate families, who are excluded from both settlement classes by the terms of the settlement
- Anyone who did not submit a claim form before the December 18, 2025 deadline, which has now passed with no new claims being accepted
This settlement is closed to new claims as of this writing. This eligibility summary describes who was historically covered by each settlement class, not an open opportunity to file. If you submitted a timely claim and have questions about payment status, contact Kroll Settlement Administration, the court-appointed administrator, directly rather than filing a new claim.
What Is the Current Status of the AT&T MDL?
The current status of the AT&T lawsuit is a preliminarily approved settlement awaiting final court approval, not a closed or dismissed case. Judge Ada Brown of the U.S. District Court for the Northern District of Texas granted preliminary approval on June 20, 2025, and held a final approval hearing on January 15, 2026, but had not yet ruled on final approval as of this writing.
In re: AT&T Inc. Customer Data Security Breach Litigation
Numerous individual AT&T data breach lawsuits filed in state and federal courts were consolidated into this single MDL before Judge Ada Brown. AT&T denied liability but agreed to resolve the consolidated action for $177 million combined, and the court preliminarily approved the settlement, conditionally certified the two settlement classes, and appointed Kroll Settlement Administration LLC to administer claims.
| Court | U.S. District Court, Northern District of Texas, Dallas Division |
| MDL Docket | 3:24-md-03114-E |
| Case Number | 3:24-cv-00757-E |
| Judge | Ada Brown |
| Settlement Administrator | Kroll Settlement Administration LLC |
| Preliminary Approval | June 20, 2025 |
| Claims Deadline | December 18, 2025 (passed) |
| Final Approval Hearing | January 15, 2026 (ruling still pending as of this writing) |
Roughly 4.38 million claims were filed before the December 18, 2025 deadline, according to public reporting on the settlement's progress. No payment date has been announced, since payments cannot begin until the court grants final approval and any post-approval appeal period runs.
What Is the AT&T Lawsuit Payout Per Person?
Eligible claimants can generally receive up to $5,000 from the AT&T 1 fund and up to $2,500 from the AT&T 2 fund, for a combined maximum of $7,500 if the same person was affected by both incidents, though most individual payments will likely be far lower once the funds are divided among roughly 4.38 million claims.
These figures come from the settlement's own published tiers, not a court-ordered guarantee of any specific dollar amount. Actual per-person payments depend on how many valid claims are ultimately approved, the documented losses each claimant reports, and deductions for settlement administration costs and any court-approved attorneys' fees, and cannot be confirmed until the court grants final approval.
AT&T 1 claimants who document actual, unreimbursed losses tied to the breach may be eligible for a higher tiered payment than claimants relying on the base cash payment alone, according to the settlement's published claim tiers, though the exact final amount for any individual claim will not be known until the settlement fund is calculated and distributed.
AT&T Lawsuit Updates
Here is the current status of the AT&T lawsuit, updated with new filings and rulings as they're confirmed. The case has a reached settlement still awaiting final court approval as of this writing.
AT&T Lawsuit Timeline of Events
Court Holds Final Approval Hearing
Judge Ada Brown held the final approval hearing for the $177 million AT&T settlement on January 15, 2026, a date previously rescheduled from an earlier December 3, 2025 hearing, and had not issued a final ruling as of this writing.
Claims-Filing Deadline Passes
December 18, 2025 was the deadline to submit a claim form in both the AT&T 1 and AT&T 2 settlement classes, and online and mailed claim forms are no longer being accepted after that date.
Settlement Administration Confirms the $177 Million Deal
The settlement administrator confirmed on August 4, 2025 that AT&T had reached a $177 million combined settlement, split into $149 million for the AT&T 1 class and $28 million for the AT&T 2 class.
Court Grants Preliminary Approval
Judge Ada Brown granted preliminary approval of the AT&T settlement on June 20, 2025, conditionally certified both settlement classes, and appointed Kroll Settlement Administration LLC to oversee the claims process.
AT&T Discloses the AT&T 2 Cloud Platform Incident
AT&T disclosed a second, separate data incident on July 12, 2024, involving customer call and text records downloaded without authorization from a third-party cloud platform AT&T used.
AT&T Confirms the AT&T 1 Dark-Web Data Incident
AT&T confirmed on March 30, 2024 that a dataset containing personal information for roughly 73 million current and former customers had circulated on a dark-web forum, after previously denying the data came from its systems.
How to File an AT&T Lawsuit
Below are the 4 steps involved in filing an AT&T lawsuit.
- Check whether you fell within a covered class: Review the eligibility windows above for the AT&T 1 dark-web incident and the AT&T 2 cloud-platform incident, since each covered a different group of AT&T customers based on which incident affected them.
- Look up your claim status with the official administrator: Kroll Settlement Administration LLC is the only court-appointed administrator for this case; the official settlement website is the authoritative source on a previously filed claim's status.
- Confirm the claims deadline has passed: The December 18, 2025 deadline to file a new claim in either settlement class has already passed, so anyone who has not yet filed cannot submit a new claim in this settlement.
- Watch for a final approval ruling before expecting payment: Payments cannot go out until the court grants final approval, which had not happened as of this writing, so a claimant who already filed should expect a delay before any check or electronic payment arrives.
AT&T Lawsuit is no longer accepting new claims. The claims-filing deadline for both AT&T 1 and AT&T 2 settlement classes passed on December 18, 2025, and the settlement is still awaiting final court approval as of this writing.
What Did AT&T Say About the Two Data Breaches?
AT&T has denied responsibility for the underlying criminal conduct in both data incidents while agreeing to the $177 million settlement to resolve the consolidated litigation. AT&T has not been found liable in this case, and the presiding court has not ruled on the merits of plaintiffs' allegations.
When the AT&T 1 dataset first appeared on a dark-web forum, AT&T initially said the information had not come from its own systems and that it had not suffered a breach, before confirming the incident in March 2024. In a public statement about the settlement, AT&T said: "While we deny the allegations in these lawsuits that we were responsible for these criminal acts, we have agreed to this settlement to avoid the expense and uncertainty of protracted litigation," adding that it remains "committed to protecting our customers' data."
Is the AT&T Data Breach Lawsuit the Same as the California Ad Lawsuit?
No. "AT&T lawsuit" describes more than one legally distinct case against the company, and conflating them misattributes facts from one case to another. Only the consolidated data breach MDL described on this page is the subject of this article; two other real, separate AT&T matters turned up in research and are summarized here strictly for disambiguation.
The California Attorney General filed a separate consumer-protection complaint, People of the State of California v. AT&T Mobility, LLC; Cricket Wireless, LLC, in San Francisco County Superior Court, alleging AT&T Mobility and its Cricket Wireless subsidiary made misleading "unlimited data," "switch-and-save," and free-device marketing claims, in violation of California's Unfair Competition Law and False Advertising Law. That case involves advertising practices, not data security, and has no connection to the data breach settlement described above.
Separately, the Federal Trade Commission sued AT&T years earlier over "data throttling," the practice of slowing data speeds for customers on unlimited plans after they crossed a monthly threshold. That FTC case already resolved, and the agency has continued sending refund payments, including ongoing Zelle payments as of this writing, to customers who had not cashed an earlier check or accepted a PayPal payment. It is also unrelated to the 2024 data breach settlement covered on this page.
| Case | What It's About | Court / Agency | Status |
|---|---|---|---|
| Data breach MDL (this page) | 2024 dark-web and cloud-platform data incidents | U.S. District Court, N.D. Texas (MDL 3114) | $177M settlement, pending final approval |
| People v. AT&T Mobility (unrelated) | Unlimited data, switch-and-save, and free-device advertising claims | San Francisco County Superior Court | Complaint filed by California Attorney General |
| FTC data-throttling refunds (unrelated) | Slowing data speeds on unlimited plans | Federal Trade Commission | Resolved; refund payments still being sent |
Frequently Asked Questions
What is the AT&T lawsuit about?
The AT&T lawsuit, formally In re: AT&T Inc. Customer Data Security Breach Litigation, is a consolidated federal class action alleging AT&T failed to protect customer data in two separate 2024 incidents: a dark-web leak of personal information and a separate breach exposing call and text records through a third-party cloud platform.
Is the AT&T lawsuit a class action?
Yes. It is a consolidated federal class action (MDL Docket No. 3:24-md-03114-E) before the U.S. District Court for the Northern District of Texas, with two settlement classes, AT&T 1 and AT&T 2, that the court has preliminarily but not yet finally certified.
Has the AT&T lawsuit settled?
The parties reached a $177 million settlement, and the court granted preliminary approval on June 20, 2025, but final approval is still pending as of this writing following a January 15, 2026 hearing. The settlement is not fully final until the court rules on final approval.
Can I still file a claim in the AT&T settlement?
No. The deadline to file a new claim in either the AT&T 1 or AT&T 2 settlement class was December 18, 2025, and that deadline has passed. Anyone who submitted a timely claim should contact Kroll Settlement Administration, the court-appointed administrator, for status questions rather than filing a new claim.
How much money will AT&T customers get from the settlement?
Eligible claimants can generally receive up to $5,000 from the AT&T 1 fund and up to $2,500 from the AT&T 2 fund, for a combined maximum of $7,500 if affected by both incidents, though actual individual payments will likely be lower once the funds are divided among the roughly 4.38 million claims filed and cannot be confirmed until the court grants final approval.
Is the AT&T data breach lawsuit the same as the California AT&T advertising lawsuit?
No. The data breach MDL covered on this page is a separate, distinct matter from People v. AT&T Mobility, a California Attorney General complaint over unlimited data, switch-and-save, and free-device advertising claims, and from the earlier, already-resolved FTC data-throttling refund matter.