AT&T may pay customers up to $7,500 in $177 million data breach settlement

CNN

8 hours ago

Millions of AT&T customers can file claims worth up to $7,500 in cash payments as part of a $177 million settlement related to data breaches in 2024.
The telecommunications company had faced a pair of data breaches, announced in March and July 2024, that were met with lawsuits.
Here's a breakdown.
On March 30, 2024, AT&T announced it was investigating a data leak that had occurred roughly two weeks prior. The breach had affected data until 2019, including Social Security numbers, and the information of 73 million former and current customers was found in a dataset on the dark web.
Four months later, the company blamed an 'illegal download' on a third-party cloud platform that it learned about in April for a separate breach. This leak included telephone numbers of 'nearly all' of AT&T cellular customers and customers of providers that used the AT&T network between May 1 and October 31, 2022, the company said.
The class-action settlement includes a $149 million cash fund for the first breach and a $28 million payout for the second breach.
AT&T customers whose data was involved in either breach, or both, will be eligible. Customers eligible to file a claim will receive an email notice, according to the settlement website.
AT&T said Kroll Settlement Administration is notifying current and former customers.
The deadline to submit a claim is November 18. The final approval hearing for the settlement is December 3, according to the settlement website, and there could be appeals following an approval 'and resolving them can take time.'
'Settlement Class Member Benefits will begin after the Settlement has obtained Court approval and the time for all appeals has expired,' the website states.
Customers impacted by the March incident are eligible for a cash payment of up to $5,000. Claims must include documentation of losses that happened in 2019 or later, and that are 'fairly traceable' to the AT&T breach.
For the breach announced in July, cash payments go up to $2,500. Documentation is needed for 'losses that occurred on or after April 14, 2024.'
A customer affected by both breaches could be eligible for up to $7,500, but documentation for each loss must be unique, according to the website.
Alternatively, customers can file a claim for a tier cash payment. According to the settlement website, anyone whose Social Security Number was exposed in the March breach would receive five times the payment of the second tier, including anyone who had another data element exposed. Anyone impacted by the second breach would receive an equal share of remaining funds.
However, there's no guarantee that customers would get a substantial payout.
'The amount of money that will be available for Settlement Class Member Cash Payments is unknown at this time,' according to the settlement website.
AT&T said in a statement that it denies allegations from the lawsuits that it was responsible 'for these criminal acts' from the date breach, but 'agreed to this settlement to avoid the expense and uncertainty of protracted litigation.'
'We remain committed to protecting our customers' data and ensuring their continued trust in us,' the company wrote.
In 2024, an AT&T spokesperson told CNN that the March breach had 'no connection in any way' to the July announcement.
AT&T said it expects the settlement will be approved by the end of the year.
Eva Rothenberg contributed to this report.