AT&T Nationwide Data Breach Class Action

In March 2024, AT&T confirmed that a dataset containing the personal information of approximately 73 million current and former customers had been published on the dark web. The exposed records — believed to stem from a breach dating as far back as 2021 — included full names, home addresses, phone numbers, dates of birth, email addresses, Social Security numbers, and AT&T account passcodes. The company initially denied ownership of the dataset when it first surfaced in 2021, only acknowledging the breach three years later after independent security researchers confirmed the data's authenticity. Critics condemned the multi-year delay as a serious failure of corporate responsibility.

Class action plaintiffs allege that AT&T was negligent in protecting customer data, violated the Federal Communications Act's duty to protect customer proprietary network information (CPNI), and ran afoul of multiple state consumer protection and data breach notification statutes by failing to timely alert affected individuals. The lawsuits seek damages for the ongoing risk of identity theft, fraudulent account openings, and financial harm that victims face as a result of the exposure of their most sensitive identifiers. With an estimated 73 million affected individuals, this ranks among the largest telecommunications data breaches in U.S. history.