Loading story…
AT&T has agreed to a $177 million class-action settlement following two significant data breaches that exposed sensitive customer information. The first breach, involving account files from 2019 or earlier, compromised data such as Social Security numbers, passcodes, and other identifiers for millions of current and former customers, with the stolen data later surfacing on the dark web. The second breach, attributed to a compromise of a third-party cloud platform hosted by Snowflake in 2022 and early 2023, exposed call and text metadata, including numbers contacted and cell site information, but not the content of communications. Both incidents affected tens of millions of users, and AT&T has notified those impacted.
The settlement is divided into two funds: $149 million for victims of the first breach and $28 million for those affected by the Snowflake-related incident. Eligible customers can claim up to $5,000 for the first breach and $2,500 for the second, with a maximum of $7,500 for those impacted by both. Higher payouts are reserved for individuals who can provide documentation of out-of-pocket losses, while others will receive a share of the remaining funds. The deadline to file a claim is December 18, 2025, and both current and former AT&T customers are encouraged to review their eligibility and submit claims online or by mail.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
By mid-November 2025, public reporting said the deadline to file claims in the AT&T data breach settlement was nearing and that eligible customers could still apply for payouts of up to $7,500. The reports focused on how to submit claims rather than disclosing a new breach-related development.
AT&T reached a proposed $177 million settlement to resolve claims tied to a data breach affecting customers. The settlement created a process for eligible people to seek compensation, including reimbursement for documented losses.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AT&T disclosed multiple major security incidents affecting tens of millions of customers. In one breach, data tied to about **51 million people** was acknowledged after customer records appeared online, prompting the company to reset account passcodes for millions of users. Reporting indicated the leaked information included personal customer details, raising concerns about account takeover and fraud exposure for current and former subscribers. AT&T later revealed a separate, far broader compromise involving call and text metadata for **nearly all AT&T cellular customers**. The exposed records reportedly covered who customers communicated with and when interactions occurred, though not the content of calls or messages. Together, the incidents underscored the scale of AT&T's data security problems, spanning both subscriber account information and highly sensitive telecommunications metadata.
Jun 29, 2026
Comcast agreed to pay **$117.5M** to settle a class action tied to a large-scale breach disclosed in late 2023 that potentially affected **31M+** people. Comcast attributed the intrusion to **CitrixBleed** (Citrix NetScaler ADC/Gateway), a vulnerability that can enable **session hijacking** and credential theft; researchers warned stolen session tokens could remain valid even after patching, extending attacker access. The proposed settlement (preliminarily approved) provides reimbursement for documented losses (up to **$10,000** per person) and compensation for time spent responding, while Comcast denies wrongdoing. Separately, Google agreed to pay **$135M** to settle Android users’ claims that devices transmitted data to Google servers over **cellular networks** in the background without meaningful consent, with individual payouts capped (reported up to **$100**) and additional **injunctive relief** requiring clearer disclosures and express consent during setup. Two dermatology practices also reached settlements over cybersecurity incidents exposing patient data; one New Jersey practice reported unauthorized network access spanning **Dec 2023–Mar 2024** and exposure of **PHI/PII** (including SSNs and treatment/insurance data) affecting **373,630** individuals, offering cash benefits plus credit monitoring/identity protection while denying liability.
Jun 29, 2026
A database advertised as containing data on roughly **70 million AT&T customers** resurfaced online, reviving claims first made when a threat actor offered the records for sale in 2021. Reports said the exposed information included names, dates of birth, phone numbers, physical addresses, email addresses, and in many cases **Social Security numbers**, creating significant identity-theft and fraud risk for affected individuals. AT&T said the leaked dataset did **not** come from its systems and reiterated that its internal investigation found no evidence of a direct compromise tied to the material being circulated. Independent analysis of the files, including review by breach researcher Troy Hunt, indicated the data appeared authentic for many individuals and likely originated from an older source, leaving the central dispute unresolved: the records look real, but AT&T maintains they were not exfiltrated from the company’s environment.
Jun 29, 2026