AT&T is facing multiple class action lawsuits related to a data breach

In late March 2024, telecommunications company AT&T announced that a data breach had compromised the personal information of about 73 million people. 

AT&T said in the announcement that a dataset found on the dark web contained information including some Social Security numbers for about 7.6 million current account holders and about 65.4 million former account holders. According to AT&T, the impacted data appears to be from 2019 or earlier. 

The company said it’s unknown whether the data “originated from AT&T or one of its vendors,” adding that it had launched an investigation supported by cybersecurity experts. 

Multiple AT&T customers, including a VERIFY team member, have since received emails or letters about their personal information being compromised in the breach. 

VERIFY reader Gary told the team in an email that he has seen ads from law firms about class action lawsuits related to the AT&T data breach, and asked if the ads are scams or legit. 

THE QUESTION

Have class action lawsuits been filed against AT&T over a data breach?

THE SOURCES

• Top Class Actions
• Court records published by classaction.org and Law360
• Cohen Milstein law firm
• Beasley Allen law firm

THE ANSWER

Yes, class action lawsuits have been filed against AT&T over a data breach.

Sign up for the VERIFY Fast Facts newsletter here. 

WHAT WE FOUND

AT&T is facing multiple class action lawsuits over the data breach that was announced in late March. 

VERIFY found nearly a dozen lawsuits that have been filed against the telecommunications company as of May 1, 2024. At least one law firm is looking for people who are interested in participating in the case against AT&T.

All of the class action lawsuits filed raise similar allegations about AT&T failing to properly secure its customers’ personal information. The plaintiffs in the lawsuits are demanding jury trials and requesting various damages for affected customers.

Since the lawsuits were recently filed, it’s unclear whether or not they will ultimately lead to settlement payments.

One of the first lawsuits was filed in Texas on the same day that AT&T announced the breach. It alleges that the data breach was a “direct result” of AT&T’s “failure to implement adequate and reasonable cyber-security procedures and protocols” needed to protect customers’ personal information “from a foreseeable and preventable cyberattack.”

At least eight other class action lawsuits were filed against AT&T in Texas around the same time, court records published by the legal news service Law360 show.

Two law firms also announced additional class action lawsuits filed against AT&T over the data breach. 

A lawsuit filed by two plaintiffs on April 3, 2024 “accuses AT&T of negligence and breach of contract for failing to investigate the massive data breach for nearly three years,” Cohen Milstein law firm said in a press release. 

It alleges that AT&T learned of the breach in August 2021 when hackers auctioned off 70 million customers’ personal information in an online forum. AT&T initially denied that the data breach occurred and did not investigate further until the contents of the database were leaked on the dark web nearly three years later, the lawsuit alleges.

The law firm says people who are interested in participating in the case should complete the contact form on its website. 

Another lawsuit filed by Beasley Allen accuses AT&T of failing to “adequately protect customer data” and leaving it “vulnerable to cybercriminals,” according to a press release published by the law firm on April 23, 2024.

The lawsuit also “criticizes the telecom provider for not disclosing vital details about the breach, such as the specific timeline of the events and reasons behind the delay of over three years in informing current and former customers about the cyberattack,” Beasley Allen says.

AT&T did not comment on the allegations within the lawsuits and instead directed VERIFY to a website with information on what customers can do if their personal information was compromised.

The company says on that website that it has emailed or mailed letters to people with compromised personal information, and is offering complementary identity theft and credit monitoring services. Legitimate emails come from ATT@message.att-mail.com, the company says.

The Associated Press contributed to this report.