AT&T has secured final court approval for a $177 million settlement intended to resolve claims arising from two major customer data incidents disclosed in 2024. The cases involved different collections of information, but together they illustrate how identity records and communications metadata can continue to create risk long after an intrusion becomes public.

Judge Sidney A. Fitzwater of the US District Court for the Northern District of Texas approved the agreement on October 2. AT&T agreed to settle without admitting liability or wrongdoing. The total is divided into a $149 million fund for the first incident and a $28 million fund for the second, with legal and administrative expenses paid from those amounts.

Two breaches, two distinct sets of sensitive data

The first incident came to light in March 2024 after a large collection of AT&T-related information appeared on the dark web. The carrier said the records appeared to date from 2019 or earlier and related to roughly 7.6 million current customers and 65.4 million former customers.

The exposed fields varied from person to person. They could include names, physical and email addresses, telephone numbers, dates of birth, account passcodes, billing account numbers and Social Security numbers. At the time, AT&T said it had not established that the information came from unauthorized access to its own environment, leaving open the possibility that a vendor or another source was involved.

The second incident was disclosed in July 2024 and involved an AT&T workspace hosted on Snowflake. Attackers accessed it during April and obtained records covering calls and text-message interactions for nearly all of the company’s cellular customers. The dataset largely spanned May through October 2022, with a smaller set from January 2023.

Those records did not contain message content or Social Security numbers. They did, however, include telephone numbers, interaction counts, total call durations and, in some instances, cell-tower identifiers. That metadata can map personal or professional relationships, especially when public services are used to associate numbers with identities.

What the approved settlement provides

Eligible participants tied to the first incident may receive reimbursement of documented losses up to $5,000. People affected by the Snowflake incident may qualify for as much as $2,500. Someone included in both groups can potentially recover under both funds, although the same expense cannot be claimed twice and evidence is required for documented-loss payments.

The maximum figures should not be mistaken for automatic awards. Standard cash payments are expected to be far smaller and will depend on the number and type of valid claims. People whose Social Security numbers were involved are placed in a higher payment tier than claimants whose other information was exposed. The claims deadline passed in December 2025, and distribution will depend on review and any remaining appeals.

Security consequences outlast the court case

Settlement approval resolves a legal process, not the security impact of the exposed records. Identity attributes can be combined with information from unrelated leaks to make account-recovery fraud and targeted social engineering more convincing. Communications metadata can also give criminals useful context about family, colleagues, business relationships or frequently contacted organizations.

Current and former customers should be skeptical of unexpected calls, texts and emails that use accurate account details to create trust. They should avoid following links in unsolicited settlement messages and instead navigate independently to official channels. Where available, customers can strengthen account authentication, replace reused passwords, monitor financial accounts and review credit reports for unfamiliar activity.

Lessons for enterprises holding customer records

The two incidents underline that organizations remain responsible for understanding sensitive information across both their own infrastructure and cloud platforms. Strong identity controls, short-lived credentials, detailed access logging and alerts for unusual bulk queries can make data theft harder and speed detection.

• Inventory sensitive datasets and the vendors or cloud workspaces that store them.
• Limit service accounts and administrators to the minimum data needed.
• Monitor large exports, abnormal query patterns and access from new locations.
• Practice notification and evidence-preservation procedures before a breach occurs.

For consumers, the settlement is an important measure of accountability, but it cannot withdraw copied data from criminal markets. The durable response is continued vigilance, particularly when a message appears credible because it contains information that only a trusted company should have known.