Update: The filing period has been extended to December 18, 2025. So you have about a week or so to still get in your claim! Details follow in the original story below.
Back in 2019, hackers stole account data for roughly 74 million AT&T landline customers—including social security numbers. AT&T didn’t disclose the discovery until early 2024, when the data leaked on the dark web. Then several months later, AT&T revealed attackers also stole call data records for over 100 million wireless customers between May 1 and October 31, 2022, including those subscribed to its subsidiaries Cricket Wireless and H2O Wireless.
In response, a bunch of people got together, sued AT&T, and won.
More importantly, a judge recently granted preliminary approval to settlement terms. As it currently stands, $177 million will be distributed to those caught up in these data breaches. This includes both current and former AT&T customers. For the 2019 breach, $148 million is set aside, while the 2024 breach gets a pool of $28 million.
Payments will vary depending on how severely you were affected, with those who have documents proving damages directly related to the AT&T data leaks entitled to larger amounts. Landline customers part of the 2019 breach can get up to $5,000. Wireless customers impacted by the 2024 breach are entitled to up to $2,500.
As stated in the approval filing, eligible customers will receive a notice by physical mail or email beginning on August 4, 2025. The notice period is expected to finish by October 17, 2025. All claims must be made by November 18, 2025.
The settlement’s final approval is scheduled for December 3, 2025, which must first happen before payments begin.
Besides waiting for the notice, you should also take further steps to mitigate the effect of these major data leaks—strengthening your passwords (especially for those compromised or used on more than one site), locking down your financial life, watching out for potential scams, and keeping up with the news. Our full guide will walk you through each of these steps. They’re sadly necessary in this age of endless data leaks and breaches.