A US judge has given final approval to a $177 million class-action settlement covering two major AT&T data breaches, clearing the way for payments to eligible customers who filed valid claims.
The settlement was approved on October 2, 2026, in the US District Court for the Northern District of Texas. It resolves claims brought over two separate data incidents announced by AT&T in 2024, without an admission of liability or wrongdoing by the company.
How much could AT&T customers receive?
The settlement fund is divided into two parts: $149 million for the first class of claimants, known as AT&T 1, and $28 million for the second, known as AT&T 2.
AT&T 1 claimants may be eligible for up to $5,000 in documented losses if they can show that the losses were linked to the breach. Alternatively, they can receive a tiered cash payment, with customers whose Social Security numbers were exposed eligible for the higher tier.
Members of the AT&T 2 class may claim up to $2,500 for documented losses. Some may instead receive a pro-rata cash payment from the remaining settlement fund.
Court filings estimated that the typical tiered payments would be considerably lower than the maximum amounts. The estimated figures were about $39 to $40 for AT&T 1’s highest tier, roughly $7.50 to $8.10 for the lower AT&T 1 tier, and around $6.50 to $7.10 for the AT&T 2 payment.
The final amounts will depend on the number of valid claims, administrative expenses, legal fees and any approved service awards. Nearly five million claim forms had reportedly been submitted by August 24.
When will AT&T settlement payments be sent?
No payment date has been announced. The court-authorised settlement administrator, Kroll Settlement Administration, must complete its review of claims and wait for the appeals period to expire before distributions can begin.
The deadline to submit a claim was December 18, 2025, meaning customers who did not file by then cannot join the settlement. People who received notices that their claims were deficient were given until September 8, 2026, to provide additional information.
Claimants who remain eligible will receive payments using the contact and payment details held by the settlement administrator. The settlement website is expected to provide further updates as the distribution process progresses.
What happened in the AT&T data breaches?
The first incident involved a data set released on the dark web in March 2024. AT&T said it affected about 7.6 million current account holders and 65.4 million former account holders, with information including some customers’ names, addresses, account passcodes and Social Security numbers.
The second breach, disclosed in July 2024, involved the illegal downloading of call and text records from an AT&T workspace hosted on Snowflake, a third-party cloud platform. AT&T said the records covered about six months of communications data from 2022 and affected nearly all of its customers.
The information involved in the second incident included telephone numbers, interaction counts, aggregate call durations and, for a small number of people, cell site identification numbers.
AT&T has denied wrongdoing. In a statement issued during the litigation, the company said it had agreed to the settlement “to avoid the expense and uncertainty of protracted litigation” and remained committed to protecting customer data.
