AT&T has reached a significant class-action settlement of $177 million (£133.9 million), potentially benefiting millions of its current and former customers in the United States following two major data breaches in the past. Based on the information revealed and recorded losses, compensation could amount to approximately $7,500 (£5,600).
Here's what you need to know.
When and How the Data Breach Occurred
In 2024, AT&T revealed two separate security breaches that compromised the personal information of tens of millions of its customers.
The first breach, announced in March 2024, involved a dataset dating from 2019 or earlier that had surfaced on the dark web. The leaked information reportedly included names, addresses, phone numbers, email addresses, dates of birth, billing account numbers, passcodes, and for some customers, even Social Security numbers.
The second incident, revealed in July 2024, involved a cloud storage platform operated by a third party. AT&T has reported that the metadata associated with calls and texts for almost all customers, which includes phone numbers, call durations, and interaction counts, was downloaded illegally. The content of calls remained secure, yet the metadata raised significant concerns regarding privacy.
The breach of information has led to a surge of legal actions. In March 2025, various lawsuits were brought together, and the company opted to settle while denying any wrongdoing.
Settlement Details and Implications
Under the terms of the settlement, AT&T has allocated $177 million (£133.9 million) to provide compensation to customers who were affected. About $149 million (£112.7 million) was designated for those impacted by the initial breach and $28 million (£21.2 million) for the subsequent incident.
Payouts will depend on the type of breach and whether a claimant can shows provable losses—or, alternatively, qualify based on exposure of key personal data.
Are You Eligible?
According to Kroll Settlement Administration, the organisation overseeing AT&T's legal settlement, your eligibility is determined by the specific breach that impacted you. This could be the first incident, the second one, or both.
- First breach (AT&T 1 Settlement Class): This includes people whose personal information such as name, address, date of birth, contact details, or Social Security number was exposed. If your Social Security number was leaked, you are in Tier 1 and could receive up to $7,500 (£5,600). If other personal information was exposed, you are in Tier 2, with payouts typically around $400-$700 (£300-£520).
- Second breach (AT&T 2 Settlement Class): This applies to customers whose call or text metadata—including phone numbers, call lengths, and message counts—was compromised. Payments for this group generally range from $100-$200 (£75–£150).
- Affected by both breaches: If you were impacted by both incidents, you may be eligible for compensation from both settlements, potentially increasing your total payout.
If you have received a notification from AT&T or the settlement administrator through a letter or email, it is highly probable that you are part of the settlement. Regardless of whether you received a notice, you still have the option to verify your eligibility online.
How to File a Claim
To seek compensation, affected customers must submit a claim:
- Visit the official settlement website: www.telecomdatasettlement.com
- Log in using your Class Member ID, which is sent by post or email from the settlement administrator. You may also fill in the form manually if you believe you are eligible but did not receive a notice.
- Choose the type of claim. Pick the Documented Loss Cash Payment if you can show losses directly related to the incident or the Tier Cash Payment if you were exposed but have no documented loss.
- Provide necessary information and, if claiming documented losses, appropriate supporting evidence, such as bills, invoices, and any other proof.
According to the administrator, failure to file a claim means you forfeit your right to payment under the settlement.
Claims from eligible customers are required to be submitted by 18 December 2025. This is relevant for both digital submissions and physical forms, which need to be postmarked by the specified date.
A concluding session to endorse the agreement is set for early 2026. The total amount and schedule of payments will be determined by the quantity of valid claims, as well as the associated legal and administrative expenses, pending the judge's final approval.
What to Do Next
If you were ever an AT&T customer in the US, it's worth checking whether you were affected by one of the breaches. Even if you no longer use AT&T services, former account holders are included.
The potential payouts—up to around $7,500 (£5,600)— may not be life‑changing but could help offset costs associated with identity monitoring, credit protection or data mitigation.
