AT&T Customer Data Breach Class Action

In March 2024, AT&T confirmed that a dataset containing sensitive personal information for approximately 73 million current and former customers had been leaked on the dark web. The exposed data included full names, home addresses, phone numbers, dates of birth, Social Security numbers, and AT&T account passcodes. AT&T acknowledged that the data appeared to be from a 2019 breach but had only surfaced publicly in early 2024. Plaintiffs allege that AT&T failed to implement adequate cybersecurity safeguards and unreasonably delayed notifying affected customers, violating multiple state and federal data protection obligations.

A second, distinct AT&T data breach was disclosed in July 2024, revealing that hackers had accessed the call and text message records of nearly all AT&T wireless customers — approximately 109 million people — covering a six-month period in 2022. The records included phone numbers contacted, call durations, and cell site location data. Multiple class action lawsuits have been filed in federal court and consolidated, and the matter has drawn investigations from the FCC and state attorneys general. No global settlement has been announced, and the litigation is in active discovery as of 2025.