AT&T’s proposed settlement of a class action lawsuit involving data breachesreportedly received a judge’s preliminary approval Friday (June 20).
The judge ruled that the proposed $177 million settlement was fair and reasonable, Reutersreported Friday.
The class action lawsuit against AT&T centered on data breaches announced by the firm in May 2024 and July that exposed personal information about tens of millions of the firm’s customers, according to the report.
In the settlement, AT&T would pay up to either $2,500 or $5,000, depending on the incident, to customers who suffered losses “fairly traceable” to the data breaches, and then distribute the remaining funds to other customers whose personal information was accessed, per the report.
AT&T said in the report that it denied it was “responsible for these criminal acts” and that it agreed to the settlement “to avoid the expense and uncertainty of protracted litigation.”
The company said in July thatrecords of calls and texts ofnearly all its wireless customers and others using its network were stolen in a cybersecurity incident.
The stolen records identify the telephone numbers with which the wireless numbers of AT&T or mobile virtual network operators (MVNOs) using AT&T’s wireless network interacted between May 1 and Oct. 31, 2022, and on Jan. 2, 2023, the firm said at the time.
The stolen data does not include the content of the calls or texts or personally identifiable information.
“While the data does not include customer names, there are often ways, using publicly available online tools, to find the name associated with a specific telephone number,” AT&T said in a July 12, 2024,filing with theSecurities and Exchange Commission (SEC).
The cybercriminals’ theft of the data was believed to have stemmed from an earlierdata breach on cloud storage and data warehousing vendorSnowflakePYMNTS reported at the time.
In September, AT&T reached a settlement with theFederal Communications Commission (FCC) that resolved the agency’s investigation into a January 2023 hack in which AT&Tcustomer information was taken from a vendor’s cloud environment.
A consent decree resolving the investigation required AT&T to pay $13 million and to strengthen its data governance practices.
