AT&T's $177M settlement over two 2024 breaches won final approval in October 2026

On October 2, 2026, Senior US District Judge Sidney A. Fitzwater granted final approval to AT&T's $177 million settlement of the multidistrict litigation over two 2024 incidents, in a 73-page memorandum opinion that also awarded $59 million in attorney fees and modified the cy pres process governing leftover funds. Nearly 4.92 million claims had already been filed by the time the order came down.

The first fund, worth $149 million, covers the incident court filings label 'AT&T 1': a dataset covering roughly 73 million current and former account holders — Social Security numbers, account and banking-related information — disclosed on March 30, 2024 after surfacing on the dark web. AT&T initially said the dataset appeared to originate from 2019 or earlier and did not come from its current systems.

The second fund, worth $28 million, covers 'AT&T 2': an unauthorized download from an AT&T workspace hosted on Snowflake's cloud platform, disclosed on July 12, 2024, exposing phone numbers, call and text interaction records, and account owner and user data — part of the wider 2024 wave of attacks against Snowflake customers. 'Overlap Members' caught in both incidents can claim against both funds, though terms block double recovery for the same type of harm.

The payout math is sobering: with 4,163,810 electronic and 754,263 paper claims chasing $177 million minus fees and administration costs, most tiered claimants receive a few hundred dollars despite the 'up to $5,000' documented-loss ceiling. Claim counts across the three tiers of the AT&T 1 fund ran 1,654,046, 687,859 and 1,582,248.

$177M settlement across two funds ($149M and $28M), plus $59M in attorney fees approved alongside it.

A dataset covering 73 million current and former account holders — including Social Security numbers — was outside AT&T's control and surfaced on the dark web.

Call and text metadata sat in a third-party Snowflake workspace that was raided in the 2024 campaign against Snowflake customer environments.

The defense that the older dataset predated AT&T's current systems did not stop the settlement from treating both incidents as compensable.

The judge rejected objections that the deal shortchanged victims, approving a structure that leaves most claimants a few hundred dollars each.

Courts no longer discount a breach because it happened on a vendor's cloud: the workspace raid and the legacy leak were treated as separate compensable events.

Final approval landed roughly two and a half years after the first disclosure, slowed by the originally assigned judge's recusal and reassignment to Fitzwater. Distribution typically follows final approval by several months once the appeals period closes. The civil deal does not end regulatory exposure: reporting on the approval does not confirm an active FCC or state attorney general proceeding tied to either incident, and telecom data handling sits under overlapping FCC, FTC and state jurisdiction. For scale, T-Mobile paid $350 million for its 2021 breach.