AT&T Could Owe You Up to $7,500. Here's How It Works and How to File a Claim

CNET

3 hours ago

The two AT&T data breaches included nearly 200 million people.
jetcityimage/Getty Images
Six years after its first data breach of 7.6 million customers and 16 months after a second breach that included a whopping 109 million customers, time is running out for AT&T to pay the piper. In the coming months, the telecom giant will pay out a total of $177 million to people impacted by either or both breaches.
On June 20, US District Judge Ada E. Brown preliminarily approved the settlement of a class-action privacy lawsuit against AT&T. The suit arose from two massive data breaches revealed in 2024. The settlement administration began accepting claims from affected customers on Aug. 4.
The proposed legal settlement for the two AT&T breaches divides claimants into two distinct classes, although people affected by both breaches can file a claim for both.
If you were affected and want to file a claim for compensation, you'll need to act by Nov. 18, 2025, or get left out. Read on to learn more about the gigantic AT&T legal settlement -- including how to file a claim and how much money you might receive -- and the data breaches that led to it.
Don't miss any of CNET's unbiased tech content and lab-based reviews. Add us as a preferred Google source on Chrome.
What were these data breaches that prompted the lawsuits against AT&T?
The two data breaches related to AT&T's current $177 million settlement occurred in 2019 and 2024, although the company didn't acknowledge the 2019 breach until March 2024, weeks after it detected customer data spreading on the dark web.
The 2019 breach involved personal data including Social Security numbers, birth dates and legal names, and it affected 7.6 million current AT&T customers and 65.4 million former account holders. Soon after the disclosure, AT&T took the dramatic step of resetting passwords for all current customers who were included in the breach.
The second data breach covered by the legal settlement happened soon after the disclosure of the first. In April 2024, hackers accessed phone records from 2022 for nearly all of AT&T's US customers (about 109 million) from Snowflake, the company's cloud-based data warehouse. AT&T disclosed the breach in July 2024.
Associates of the hacker group ShinyHunters claimed responsibility for similar Snowflake attacks on about 165 companies in mid-2024. Two people were eventually arrested for the AT&T hack.
A rash of lawsuits for both data breaches were filed after both of AT&T's disclosures and were consolidated soon after. All parties in both of the breach lawsuits agreed to a settlement in March 2025.
The class affected by "AT&T 1 Data Incident" (the 2019 breach) will receive a $149 million payout in the proposed settlement, while the class included in "AT&T 2 Data Incident" (the 2024 Snowflake breach) will receive $28 million.
How can people file a claim for part of the AT&T settlement?
Kroll Settlement Administration, the organization managing AT&T's legal settlement, has created a website at telecomdatasettlement.com where eligible class members can file claims for compensation.
To file a claim for part of the settlement, you'll need to have a "Class Member ID," which should have come in a notification from Kroll, most likely by email. If you cannot find the email, be sure to check your spam folder or other email filters.
You'll need to retrieve your Class Member ID from the notification you received, or else call the administrators to get an ID.
Kroll Settlement Administration/Screenshot by CNET
If you believe you should be included in either part of the AT&T settlement and did not receive a notification, or if you're not sure if you're included, you can call the settlement administrator at 833-890-4930, or write to it at AT&T Data Incident Settlement; c/o Kroll Settlement Administration LLC; P.O. Box 5324; New York, NY 10150-5324.
Once you have a Claim Member ID from Kroll, you can complete the filing forms, including any documented information about losses you experienced due to either breach or both.
Traffic to the website for the AT&T settlement has been metered. I recently checked the claim submission form and received a Cloudflare warning: "We are experiencing a high volume of traffic and using a virtual queue to limit the amount of users on the website at the same time." I had to wait 2 minutes to get in.
If you don't want to submit a claim online, you can also print and mail the settlement forms (all PDFs): claim for the 2019 breach; claim for the 2024 Snowflake breach; claim for people affected by both breaches. Mailed forms should be sent to the Kroll address above and postmarked by the same Nov. 18, 2025, deadline.
Maximum payouts for the AT&T privacy settlement
How much could victims receive if they were included in one or both of the specific AT&T data breaches? Many payouts will be ultimately based on the number of people who file claims, but we have some estimates from the terms of the settlement.
People affected by the 2019 data breach who can prove a "documented loss" can receive up to $5,000. If someone cannot prove that loss, they'll receive one of two tiered cash payments, based on whether or not their Social Security number was included in the breach.
For the Snowflake breach of 2024, AT&T customers who were affected and can prove that same demonstrated loss with documentation can receive up to $2,500. Those who were affected but have no proof of loss will receive a "pro rata" share of the remaining money, meaning it will be divided up evenly among them.
Those affected by both the 2019 and 2024 data breaches can file claims for both classes. While it's not entirely clear yet if someone with two demonstrated losses could receive the full amount of $7,500, there's nothing in the language of the settlement site that says they couldn't.