AT&T data breach lawsuit

The docket record

Full docket title: IN RE: AT&T Inc. Customer Data Security Breach Litigation. Programmatic record page: MDL 3114.

Where it stands

This MDL consolidates lawsuits over two separate AT&T data incidents: the 'AT&T 1 Data Incident,' a data set with 2019-era customer information (names, addresses, phone numbers, email addresses, dates of birth, account passcodes, billing account numbers, and in some cases Social Security numbers) that AT&T announced on March 30, 2024, had appeared on the dark web; and the 'AT&T 2 Data Incident,' a separate breach AT&T announced on July 12, 2024, involving call and text metadata (numbers contacted, interaction counts, aggregate call durations, and for a subset of records, cell site identifiers) illegally downloaded from an AT&T workspace on a third-party cloud platform hosted by Snowflake, Inc. The AT&T 1 lawsuits were centralized into this MDL (No. 3114) before Judge Ada E. Brown in the Northern District of Texas in June 2024; the AT&T 2 lawsuits were centralized separately into MDL No. 3126 before Judge Brian Morris in the District of Montana in October 2024. In March 2025 the parties agreed to settle both sets of claims together in the Northern District of Texas, and on May 30, 2025 plaintiffs filed a Consolidated Class Action Complaint. The court preliminarily approved the combined settlement (Dkt. 298), later amending the deadline schedule on October 3, 2025 (Dkt. 342). Under the amended schedule, the opt-out and objection deadline was November 17, 2025, and the deadline to submit a Claim Form was December 18, 2025; both have passed and the claim form is no longer available. The court held a Final Approval Hearing on January 15, 2026. As of the settlement website's April 23, 2026 posted update, the court had not yet decided whether to grant final approval, and the settlement administrator (Kroll Settlement Administration LLC) was continuing to review submitted claims. No payments will go out until final approval is granted and any appeals are resolved. On August 17, 2026, the JPML reassigned pretrial proceedings from Judge Brown to Senior District Judge Sidney A. Fitzwater. As of the JPML's report dated September 1, 2026, 140 actions were pending in MDL No. 3114.

Sources: Pending Multidistrict Litigation Dockets by Actions Pendi… · In re: AT&T Inc. Customer Data Security Breach Litigation… · MDL 3:24-md-03114, In re AT&T Inc. Customer Data Security… · Notice: Contact information for Kroll Settlement Administ…; full list at the end of this page.

Official claims administrator: www.telecomdatasettlement.com/ · claim deadline published as December 18, 2025. Claims are filed there, never here.

What the lawsuits are about

AT&T disclosed two separate data incidents in 2024. On March 30, 2024, AT&T announced that a data set containing AT&T-specific customer fields, drawn from information dating to 2019 or earlier, had been posted on the dark web; the compromised fields could include names, addresses, phone numbers, email addresses, dates of birth, AT&T account passcodes, billing account numbers, and for some customers, Social Security numbers ('AT&T 1 Data Incident'). Then, on July 12, 2024, AT&T announced a second, unrelated incident: certain call and text metadata for nearly all AT&T wireless customers had been illegally downloaded from an AT&T workspace hosted on a third-party cloud platform operated by Snowflake, Inc. ('AT&T 2 Data Incident'). That data reportedly included phone numbers customers interacted with, counts and aggregate durations of those interactions, and, for a smaller subset of records, cell site identification numbers tied to the interactions. Plaintiffs in both sets of lawsuits allege AT&T failed to adequately secure customer data and did not provide timely notice; these are allegations from plaintiffs' complaints, not proven facts, and AT&T has not admitted liability or wrongdoing.

Lawsuits over the AT&T 1 Data Incident were filed in state and federal courts nationwide and, in June 2024, the Judicial Panel on Multidistrict Litigation centralized the federal actions into MDL No. 3114, captioned In re: AT&T Inc. Customer Data Security Breach Litigation, assigning the litigation to Judge Ada E. Brown in the U.S. District Court for the Northern District of Texas, Dallas Division. Lawsuits over the separate AT&T 2 Data Incident were centralized into a different MDL, No. 3126, In Re Snowflake, Inc. Data Breach Litigation, before Judge Brian Morris in the District of Montana in October 2024. In March 2025, the parties in both sets of actions agreed to resolve them together as a single combined settlement in the Northern District of Texas, and on May 30, 2025, plaintiffs filed a Consolidated Class Action Complaint asserting claims arising from both data incidents.

The court preliminarily approved the combined settlement and, on October 3, 2025, granted a joint motion extending the settlement's remaining deadlines (Dkt. 342): the deadline to opt out or object was set for November 17, 2025, and the deadline to submit a Claim Form was set for December 18, 2025. Both deadlines have passed. The court held a Final Approval Hearing on January 15, 2026, in Dallas, and as of the settlement website's April 23, 2026 update had not yet ruled on final approval; the settlement administrator continued reviewing submitted claims in the meantime. On August 17, 2026, the JPML reassigned the MDL from Judge Brown to Senior District Judge Sidney A. Fitzwater for continued pretrial proceedings. As of the JPML's report dated September 1, 2026, 140 actions remained pending in MDL No. 3114.

Injuries named in the filings

• Increased risk of identity theft and fraud following exposure of personal information (names, addresses, phone numbers, dates of birth, Social Security numbers, and account credentials) in the AT&T 1 Data Incident
• Emotional distress and time/money spent monitoring accounts and credit as a result of the AT&T 1 and/or AT&T 2 Data Incidents
• Documented out-of-pocket losses (e.g., costs tied to identity theft or fraud) that plaintiffs allege are traceable to one or both data incidents
• Invasion of privacy from unauthorized access to and download of call and text interaction records in the AT&T 2 Data Incident

Principal defendants: AT&T Inc.; AT&T Mobility LLC; AT&T Corporation; DirecTV, LLC; AT&T Services, Inc.; Cricket Wireless LLC.

Sources: Pending Multidistrict Litigation Dockets by Actions Pendi… · In re: AT&T Inc. Customer Data Security Breach Litigation… · MDL 3:24-md-03114, In re AT&T Inc. Customer Data Security… · Notice: Contact information for Kroll Settlement Administ…; full list at the end of this page.

Who the filings say qualifies

Who qualifies is defined by the settlement's two class definitions, published in the settlement notice and FAQ approved by the court (Kroll Settlement Administration, telecomdatasettlement.com). There are two settlement classes, and a person can be in both.

• AT&T 1 Settlement Class: any living person in the United States whose data elements (some combination of name, address, telephone number, email address, date of birth, account passcode, billing account number, or Social Security number) were included in the AT&T 1 Data Incident announced March 30, 2024
• AT&T 2 Settlement Class: any AT&T account owner, or line/end user (including customers of an MVNO carrier that runs on the AT&T network), whose data elements (phone numbers, interaction counts, aggregate call/text durations, or in a subset of cases cell site identifiers) were involved in the AT&T 2 Data Incident announced July 12, 2024
• A person included in both classes is an 'Overlap Settlement Class Member' and is eligible for benefits under both
• Excluded from either class: AT&T and its officers/directors/affiliates; the presiding judge and judicial staff; anyone who already released claims relating to the applicable incident before final approval; and anyone who timely opted out by the November 17, 2025 deadline
• To receive a Documented Loss Cash Payment (up to $5,000 for AT&T 1, up to $2,500 for AT&T 2) rather than a flat pro rata Tier payment, a claimant had to submit reasonable, non-self-prepared documentation (such as receipts) showing losses fairly traceable to the relevant incident and incurred on or after that incident through the date of claim submission
• The claim filing deadline was December 18, 2025; the settlement website states the claim form is no longer available

Source: AT&T Data Incident Settlement, Frequently Asked Questions (Kroll Settlement Administration LLC, court-authorized settlement website for MDL No. 3:24-md-03114-E).

These are the criteria in the public record, not a promise about any individual case. A law firm evaluates each case on its own facts, and limitations periods vary by state.

Key dates

1. March 30, 2024AT&T announces the AT&T 1 Data Incident: a data set with 2019-era customer information posted on the dark web, affecting current and former customers. source
2. June 5, 2024The JPML centralizes AT&T 1 Data Incident lawsuits into MDL No. 3114, assigning the litigation to Judge Ada E. Brown in the Northern District of Texas. source
3. July 12, 2024AT&T announces the separate AT&T 2 Data Incident: call and text metadata illegally downloaded from an AT&T workspace on a third-party cloud platform hosted by Snowflake, Inc. source
4. May 30, 2025Plaintiffs file a Consolidated Class Action Complaint covering both the AT&T 1 and AT&T 2 Data Incidents, after the parties agreed in March 2025 to settle both sets of claims together in the Northern District of Texas. source
5. October 3, 2025Court grants a joint motion amending the Preliminary Approval Order, setting the opt-out/objection deadline for November 17, 2025 and the Claim Form deadline for December 18, 2025. source
6. December 18, 2025Deadline to submit a Claim Form for a Settlement Class Member Benefit; the settlement website states claim forms are no longer available. source
7. January 15, 2026Court holds the Final Approval Hearing in Dallas to consider whether the settlement is fair, reasonable, and adequate. source
8. August 17, 2026The JPML reassigns the litigation from Judge Ada E. Brown to Senior District Judge Sidney A. Fitzwater for continued pretrial proceedings. source
9. September 1, 2026JPML's monthly pending-actions report lists 140 actions pending in MDL No. 3114 before Judge Fitzwater in the Northern District of Texas. source

Questions people ask

Sources: Pending Multidistrict Litigation Dockets by Actions Pendi… · In re: AT&T Inc. Customer Data Security Breach Litigation… · MDL 3:24-md-03114, In re AT&T Inc. Customer Data Security… · Notice: Contact information for Kroll Settlement Administ…; full list at the end of this page.

Track this docket

We re-read the JPML report on the first business day of each month. Get an email when this record changes: case count, status, or a settlement development.

Sources

1. U.S. Judicial Panel on Multidistrict Litigation, “Pending MDL Dockets by Actions Pending,” monthly reports July 1, 2024 to September 1, 2026. Transferee court: Northern District of Texas, Sidney A. Fitzwater.
2. Pending Multidistrict Litigation Dockets by Actions Pending, Report Date 9/1/2026, U.S. Judicial Panel on Multidistrict Litigation. Accessed September 3, 2026.
3. In re: AT&T Inc. Customer Data Security Breach Litigation, MDL No. 3114, Transfer Order (tag-along transfer), U.S. Judicial Panel on Multidistrict Litigation. Accessed September 3, 2026.
4. MDL 3:24-md-03114, In re AT&T Inc. Customer Data Security Breach Litigation (case page), U.S. District Court, Northern District of Texas. Accessed September 3, 2026.
5. Notice: Contact information for Kroll Settlement Administration LLC (Dkt. 58), identifying telecomdatasettlement.com as the only authorized settlement website, U.S. District Court, Northern District of Texas. Accessed September 3, 2026.
6. Order Granting Joint Motion to Amend Preliminary Approval Order to Extend Certain Deadlines (Dkt. 342), U.S. District Court, Northern District of Texas. Accessed September 3, 2026.
7. Order Reassigning Litigation (MDL No. 3114, to Judge Sidney A. Fitzwater), U.S. Judicial Panel on Multidistrict Litigation. Accessed September 3, 2026.
8. AT&T Data Incident Settlement — official settlement website (home page, April 23, 2026 update), Kroll Settlement Administration LLC (court-authorized settlement administrator). Accessed September 3, 2026.
9. AT&T Data Incident Settlement — Frequently Asked Questions, Kroll Settlement Administration LLC (court-authorized settlement administrator). Accessed September 3, 2026.

Settlement Record is not a law firm and does not give legal advice. We may be compensated if you request a case review and are referred to a law firm or intake partner. Settlement Record is not affiliated with any court, agency, defendant or law firm named on this page.