Two AT&T data breaches occurred in 2019 and 2024.
AT&T is still set to begin paying out $177 million in early 2026 to settle a class action lawsuit related to two data breaches, but plaintiffs now have an extra month to file for compensation. Court decision of October 3 extended the deadline to file a claim for a share of the settlement from November 18 to December 18, 2025.
Earlier this summer, U.S. District Judge Ada E. Brown granted preliminary approval to the settlement related to the 2024 violations, and on Aug. 4, the administrator overseeing the class action began accepting claims from eligible customers. Plaintiffs are divided into two groups depending on which violation affected them, but individuals affected by both incidents can file claims in each category.
“Depending on your eligibility, you may be entitled to a significant payout upon completion of the settlement. But you'll have to act quickly: The deadline to file a claim for AT&T's share of the settlement is expiring. November 18, 2025. Here's what you need to know about the AT&T settlement, including how to file a claim, how much money you could receive, and details of the violations that gave rise to the lawsuit.
Never miss any of our unbiased technical content and behind-the-lab reviews. Add CNET as Google's preferred source.
What were these AT&T data leaks?
Two data breaches related to AT&T's current $177 million settlement occurred in 2019 and 2024, although the company did not acknowledge the 2019 data breach until March 2024weeks after the company discovered customer data was being spread on the dark web.
The 2019 breach affected personal information including Social Security numbers, dates of birth and legal names, and affected 7.6 million current AT&T customers and 65.4 million former account holders. Soon after disclosure AT&T Takes a Drastic Step to Reset Passwords for all current customers who were involved in the violation.
The second data breach covered by the settlement occurred shortly after the first was disclosed. In April 2024, hackers gained access to 2022 phone records of nearly all AT&T US customers (about 109 million) from Snowflake, the company's cloud data warehouse. AT&T reported the breach in July 2024.
Employees of the hacker group ShinyHunters took responsibility for the incident. Similar Snowflake attacks by approximately 165 companies in mid-2024. Two people were eventually arrested for hacking AT&T.
A number of lawsuits related to both data breaches were filed after AT&T's disclosure and were consolidated shortly thereafter. All parties to both infringement lawsuits agreed to a settlement in March 2025.
The class affected by the “AT&T Data Incident 1” (the 2019 hack) would receive a $149 million payout as part of the proposed settlement, and the class included in the “AT&T Data Incident 2” (the 2024 Snowflake hack) would receive $28 million.
How do I file a claim under the AT&T Settlement?
The Kroll Settlement Administration, the organization administering the AT&T legal settlement, has set up a website at telecomdatasettlement.com where eligible class members can file claims for compensation.
To file a claim for part of the compensation, you will need a “class member ID,” which should have come in a notice from Kroll, most likely via email. If you can't find the email, be sure to check your spam folder or other email filters.
You will need to get the class member ID from the notification you received or call the admins to get the ID.
If you think you should be included in any part of the AT&T agreement but have not received notification, or if you are not sure whether you are included, you can call the agreement administrator by telephone. 833-890-4930or write to him at AT&T Data Incident Settlement; c/o Kroll Settlement Management LLC; PO Box 5324; New York, NY 10150-5324.
Once you receive a Claimant ID from Kroll, you can complete claim forms, including any documented information about the losses you suffered due to the breach or both.
Traffic on the AT&T billing website is measured. I recently checked the claim form and received a warning from Cloudflare: “We are experiencing a high volume of traffic and are using a virtual queue to limit the number of users on the website at one time.” I had to wait 2 minutes to get in.
If you do not want to file your claim online, you can also print and mail settlement forms (all in PDF format): infringement claim in 2019; Snowflake hack lawsuit 2024; lawsuit for people affected by both violations. Mailed forms must be sent to the Kroll address listed above and postmarked with the same postmark. December 18, 2025 deadline.
How much will the AT&T Confidentiality Agreement payments be?
How much money could victims receive if they were included in one or both of the specific AT&T data breaches? Many payouts will ultimately depend on the number of people filing claims, but we have some estimates from terms of settlement.
People affected by a data breach in 2019 who can prove a “documented loss” could receive up to $5,000. If someone fails to prove that loss, they will receive one of two tiered cash payments depending on whether their Social Security number was included in the violation.
For the 2024 Snowflake breach, AT&T customers who are affected and can document the same demonstrated loss could receive up to $2,500. Those who were harmed but have no proof of loss will receive a “pro rata” share of the remaining money, meaning it will be divided equally between them.
Those affected by data breaches in 2019 and 2024 can file claims under both classes. While it's not entirely clear whether a person showing two losses would be able to collect the full $7,500, there is nothing in the language of the settlement site that says they can't do so.
