Lawrence E. Gursten ( Civil Law )
The AT&T data breach settlement is one of the largest on record and the most useful thing about it is hiding in plain sight in the payout schedule. Two breaches, two separate funds, two different caps. Read the tiers and you learn something counterintuitive about how the legal system actually prices stolen data. It does not pay the most for the exposure that feels the most invasive. It pays the most for the harm you can put on a receipt.
Here is where things stand and what the numbers are really saying.
At a glance
| Detail | What we know |
|---|---|
| Case | In re: AT&T Inc. Customer Data Security Breach Litigation, N.D. Texas |
| Judge | Ada E. Brown (Dallas) |
| Total settlement | $177 million, split into two non-reversionary funds |
| Fund split | $149 million (first breach) and $28 million (second breach) |
| Preliminary approval | June 20, 2025 |
| Claims deadline | December 18, 2025 (closed) |
| Final approval hearing | January 15, 2026 |
| Status (late July 2026) | No final ruling issued, no payments distributed |
| Administrator | Kroll (official site: telecomdatasettlement.com) |
The Two Breaches And What Each One Pays
The settlement resolves two separate 2024 incidents and it treats them very differently.
| First breach (AT&T 1) | Second breach (AT&T 2) | |
|---|---|---|
| Disclosed | March 2024 | July 2024 |
| What leaked | Names, dates of birth, Social Security numbers, passcodes, from 2019 or earlier | Call and text metadata, including cell-tower data that approximates location, mostly from 2022 |
| Where | Posted on the dark web | Downloaded from AT&T’s workspace on the Snowflake cloud platform |
| Scale | About 73 million current and former account holders | Nearly all AT&T cellular customers |
| Settlement fund | $149 million | $28 million |
| Documented-loss cap | Up to $5,000 | Up to $2,500 |
A customer whose data was caught in both breaches can claim up to $7,500, with separate documentation for each. Anyone who does not want to document losses can instead take a pro rata cash payment with no paperwork and claimants whose Social Security numbers were exposed are set to receive roughly five times the standard pro rata share. The deal also includes up to 24 months of credit monitoring.
Why The Social Security Number Breach Pays More, Not The Location Rreach
This is the part worth slowing down on, because the intuition runs the other way. The second breach sounds worse. Six months of call and text records for almost every customer, with cell-tower data that can approximate where someone was, is the kind of exposure you cannot undo. Freeze your credit and a leaked Social Security number loses much of it’s power. Nobody can un-leak a record of where you were for half of 2022.
And yet the settlement priced the first breach at more than five times the second: a $149 million fund against $28 million and a $5,000 documented-loss cap against $2,500. The exposure that feels less violating is the one the settlement valued far more.
The reason is not moral, it is evidentiary. Settlement tiers track legally provable loss, not how bad the exposure feels. A stolen Social Security number produces documentation: fraudulent charges, credit-freeze fees, the hours and dollars spent restoring an identity, the kind of paper trail a claim form will accept as fairly traceable. Leaked location metadata, for all it’s menace, rarely produces a specific dollar figure a person can prove they lost.
The second breach did not even include names, Social Security numbers or financial data. So the caps are not a ranking of which breach was more disturbing. They are a ranking of which breach was easier to turn into a documented claim and that is a genuinely useful window into how data-harm cases get valued.
Where The Case Stands Now
Most coverage of this settlement reads as though checks are about to arrive. They are not and the timeline is worth stating plainly.
- June 20, 2025: preliminary approval
- Summer 2025 to December 18, 2025: claims window, now closed
- January 15, 2026: final approval hearing
- Late July 2026: still no final ruling and no payments
Roughly four million claims were filed, out of notice that reached close to 100 million people. Payments cannot begin until three things happen: the court grants final approval, the appeal period expires or any appeals resolve and the administrator finishes validating claims.
Reporting had suggested payments could start around summer 2026 if approval came cleanly, but with no ruling more than six months after the hearing, that estimate is slipping. For anyone landing here hoping to file, the window has closed and late claims are rarely accepted.
What This Settlement Is Not
If you are searching “AT&T class action lawsuit” in general, be careful about what this is. The settlement covers only the two 2024 data breaches. A few things it does not include:
- The $13 million FCC consent decree AT&T entered in September 2024, which relates to a separate January 2023 breach at a cloud vendor, not the 2024 incidents. Regulatory penalties and class settlements run on parallel tracks.
- Older AT&T disputes over marketing and data throttling, which were resolved separately and are not accepting new claims.
If a website is soliciting fresh claims for AT&T marketing or throttling issues right now, treat it as suspect. The only claims process tied to this settlement ran through Kroll and it is closed.
This is a factual summary, not legal advice. Class members with questions about their own claim should rely on the official settlement site and administrator rather than third-party pages.
