US Judge Okays $177 Million AT&T Data Breach Settlement

A federal judge granted preliminary approval for AT&T to settle multiple data breach lawsuits for $177 million.

See Also: Cyber Insurance Assessment Readiness Checklist

U.S. District Court Judge Ada E. Brown, after a Friday hearing in Dallas federal court, issued a preliminary approval order pertaining to the settlement agreement.

She said the May 30 agreement appears to be “fair, reasonable and adequate, and in the best interest of the named plaintiffs and the settlement classes.” She expects to approve it at a final hearing scheduled for December.

The 147-page settlement agreement would resolve a vast number of consolidated lawsuits against AT&T alleging that the Dallas telecommunications giant failed “to properly secure and safeguard sensitive information of its customers,” leading to the exposure of their personally identifiable information.

Under the terms of the preliminary settlement agreement, AT&T now has 30 days to “provide plaintiffs with a confidential written attestation” of the “specific, reasonable steps to further secure customer information” that it has taken or will take. The program for notifying data breach victims of their right to participate, or to opt out, is set to begin on Aug. 4, and to accept claim forms until Nov. 18.

The settlement agreement pertains to two specific data security incidents involving AT&T, one of the largest U.S. wireless telephone providers:

• Data incident 1: Dataset from 2021 circulating on the dark web that the company in March 2024 confirmed contained customer data;
• Data incident 2: Breach of customer data AT&T was storing in its account with data warehouse-as-a-service provider Snowflake, which the company confirmed in July 2024.

The settlement agreement specifies that AT&T will create an all-cash fund to address each: $149 million in cash for the first settlement class, with victims eligible for up to $5,000 “upon presentation of documented losses” that can be “fairly traced” to the incident, and $28 million in cash for the second settlement class, with victims able to seek up to $2,500 in reimbursed expenses.

Separate Incidents

What the settlement agreement refers to as the first incident involved a dataset that first appeared in 2021 on the cybercrime site RaidForums, where the notorious ShinyHunters group, aka Shinycorp, listed it for sale. The dataset pertained to 70 million AT&T customers and was released for free in March 2024 after someone uploaded it to a hacking forum.

The second incident referenced in the settlement agreement involved the breach of AT&T’s Snowflake account in April 2024, exposing call records from May 1, 2022, to Oct 31, 2022, for about 110 million customers. The company failed to secure its Snowflake account using multifactor authentication.

“The call and text records identify the phone numbers with which an AT&T number interacted during this period, including AT&T landline (home phone) customers,” the telecom said.

The stolen data was publicly leaked earlier this month when someone uploaded the dataset to a Russian hacking forum. AT&T reportedly paid a hacker $370,000 in July 2024 for a promise to delete the data. The leak included the full set of stolen Snowflake data, including 49 million unique email addresses and 44 million Social Security numbers, plus full names, physical addresses and some dates of birth, which experts warned could be readily used by fraudsters (see: AT&T Hit by Massive Reported Identity Data Leak – Again).

AT&T in September 2024 reached a $13 million settlement agreement with the U.S. Federal Communications Commission to resolve its investigation into the company’s security practices. The FCC alleged that AT&T failed to ensure that customers’ information being stored with third-party services was properly secured, and destroyed when no longer needed.

Multiple Snowflake hacking suspects have been named and detained. A federal indictment unsealed in November 2024 charged two men, Canadian national Connor Riley Moucka and U.S. national John Binns, with stealing terabytes of data from cloud platform Snowflake in a major breach impacting over 165 organizations, as well as extorting “at least 36 bitcoin” – worth $3.6 million as of Monday – from victims.

Moucka in March consented to a U.S. extradition request.

Binns was detained in Turkey over a separate 12-count indictment from 2022 that charged him with hacking telecom giant T-Mobile in 2021. He reportedly obtained Turkish citizenship – his mother is Turkish – after being detained, which could complicate efforts to extradite him to the U.S.

Authorities arrested Cameron John Wagenius, a serving U.S. Army soldier, charging him last December with illegally selling “confidential phone records information,” in what appears to be activity connected to the theft of data from Snowflake’s customers’ accounts (see: Arrest of US Army Soldier Tied to AT&T and Verizon Extortion).