A federal judge has signed off on AT&T’s $177 million data breach settlement, clearing the way for payments to flow to customers caught up in two separate 2024 security incidents. The final approval, dated October 2, 2026 according to the settlement administrator’s website, closes out nearly two years of litigation over breaches that exposed call records and account data for a large share of AT&T’s customer base. Eligible customers who filed valid claims by the December 18, 2025 deadline can now expect checks, with the maximum documented-loss recovery reaching $7,500 for people hit by both incidents.
The case, heard in the U.S. District Court for the Northern District of Texas, is one of the largest telecom data breach settlements to reach final approval in 2026. It also arrives at a moment when breach litigation volume and settlement values keep climbing across industries, from healthcare systems like the Connecticut medical data breach that cost one provider $2.7 million to state government agencies handling driver records. AT&T’s settlement is bigger by an order of magnitude, and its structure, two incidents bundled into one fund with separate payout tiers, is becoming a template other companies may end up following.
Don't miss new tech stories on Google
Add Shattered once in the Google app and our stories show up in your news suggestions.
AT&T’s $177 Million Data Breach Settlement Gets Final Sign-Off
AT&T agreed to pay $177 million to resolve consolidated litigation stemming from two data breaches disclosed in 2024, according to the settlement website and coverage from Local 12 and Yahoo Finance. The deal splits into two pools of money tied to two distinct incidents: $149 million set aside for the first breach, labeled AT&T 1 in court filings, and $28 million for the second, labeled AT&T 2. Together they cover what the settlement administrator describes as the vast majority of AT&T’s wireless customer base over the relevant period.
Final approval came on October 2, 2026, per the settlement website, as cited by WAND-TV’s coverage of the ruling. That date matters because it moves the case out of the preliminary phase, where objections and opt-outs are still live, into the distribution phase, where the settlement administrator begins cutting checks to people who already filed. AT&T agreed to the deal without admitting wrongdoing, a standard term in breach settlements that lets the company close out litigation risk without a factual finding of fault.
Two Breaches, One Settlement: What AT&T 1 and AT&T 2 Actually Cover
AT&T disclosed two separate security incidents in 2024, and both ended up folded into this single settlement even though they involved different data and different attack vectors. Keeping them separate in the payout structure, rather than merging them into one flat fund, is why some customers qualify for up to $5,000 while others cap out lower, and why a small group affected by both incidents can stack claims toward the $7,500 ceiling.
AT&T 1: The Larger Incident
AT&T 1 is the bigger of the two funds at $149 million, and it carries the higher documented-loss ceiling of $5,000 per claimant. The scale of that fund signals a breach that touched a much larger customer population than the second incident, consistent with reporting that frames AT&T 1 as the primary 2024 breach involving a broad swath of account and call-record data.
AT&T 2: The Second Breach
AT&T 2 is the smaller fund at $28 million, with documented losses capped at $2,500. According to one report cited in coverage of the ruling, AT&T 2 claimants in certain payment tiers are seeing far smaller flat payments, in the $6.50 to $7.10 range for one tier and $7.50 to $8.10 for another, reflecting how thinly a fund of this size can stretch once it is divided across a large claimant pool with no documented financial loss to point to.
How Much Money Is Actually on the Table
The headline number people are searching for is $7,500, and that figure is real, but it only applies to a narrow slice of claimants. To hit that ceiling, a customer needs documented losses tied to both AT&T 1 and AT&T 2, with up to $5,000 recoverable from the first fund and up to $2,500 from the second. Most people filing a claim without documented out-of-pocket losses will land in a much smaller flat-payment tier, the kind measured in single-digit dollars rather than thousands, because the bulk of the fund after administrative and legal costs gets spread across a customer base that likely runs into the tens of millions.
That gap between the headline ceiling and the realistic per-person payout is a pattern that shows up in nearly every mass data breach settlement, and it is worth understanding before assuming a check for thousands of dollars is coming. Investopedia’s coverage of the claims process frames the $7,500 figure as the maximum, not the typical outcome, which matches how these funds have played out in past telecom and retail breach cases.
AT&T Settlement Payout Tiers at a Glance
| Settlement Fund | Fund Size | Max Documented-Loss Payout | Lower-Tier Flat Payout |
|---|---|---|---|
| AT&T 1 | $149 million | Up to $5,000 | Varies by claim volume |
| AT&T 2 | $28 million | Up to $2,500 | $6.50-$7.10 (Tier 3), $7.50-$8.10 (Tier 2) |
| Combined (both breaches) | $177 million | Up to $7,500 | N/A |
| Attorney fees (reported) | $59 million | N/A | N/A |
| Claims deadline | December 18, 2025 | N/A | N/A |
That $59 million in reported attorney fees, detailed in Bloomberg Law’s reporting on the final order, works out to roughly a third of the total settlement value, a ratio that tends to draw scrutiny from objectors and, occasionally, from the court itself. It did not stop final approval here, but the proportion is worth watching as a benchmark the next time a nine-figure breach settlement lands in front of a judge.
The December 18 Deadline Has Already Passed, What That Means Now
Anyone hoping to file a fresh claim against this settlement is out of luck. The deadline to submit a valid claim was December 18, 2025, and only people who filed by that date are eligible for payment, according to the settlement website. That means the news of final approval on October 2, 2026 is not an invitation to act, it is a status update for people who already have a claim in the system. The nearly ten-month gap between the filing deadline and final approval is typical for settlements this size, since administrators need time to validate claims, resolve disputes, and let any appeal window close before cutting checks.
For those who did file, the practical next step is checking claim status through the settlement administrator’s portal rather than waiting on a mailed notice, since distribution timelines for funds this size often stagger payments over weeks rather than issuing them all at once. That staggered approach mirrors how the Florida DMV breach notification rollout handled its own mailing schedule earlier this year, sending letters in batches rather than a single mass mailing.
Inside the Ruling: The Judge, the Timeline, and the Legal Fees
Coverage of the final approval ruling is not entirely consistent on one detail: which judge signed off on the deal. Some reports name Judge Ada Brown, while others attribute the case to Judge Sidney Fitzwater, both of whom sit on the Northern District of Texas bench. What is consistently reported, and attributed directly to the bench, is the substance of the ruling itself. Judge Ada Brown said the settlement was “fair and reasonable” in the preliminary-approval ruling that set this case on track toward the October 2026 final sign-off.
That kind of language, fair and reasonable, is the standard legal threshold courts apply to class action settlements under federal procedure, and it is not a rubber stamp. Judges weigh the size of the fund against the scope of harm, the strength of the underlying claims, and how the money is split between claimants and attorneys before signing off. The nearly two-year gap between the 2024 breach disclosures and the 2026 final approval reflects that review process playing out across discovery, mediation, and the claims period itself.
AT&T’s Position and What “No Admission of Wrongdoing” Means
AT&T agreed to settle both breach cases without admitting fault, a term that appears in the overwhelming majority of corporate data breach settlements. It lets the company close out costly, multi-year litigation and the associated legal exposure without a court ever ruling on whether AT&T was negligent in how it secured customer data. For a company AT&T’s size, $177 million is a material but survivable cost, especially weighed against the alternative of years of continued litigation with uncertain outcomes on both sides.
It is also a familiar playbook. Equifax settled its 2017 breach for up to $425 million in a 2019 deal with the FTC and state attorneys general. Yahoo settled its 2016 breach disclosure for $117.5 million that same year. Capital One agreed to pay $190 million in 2022 over its 2019 breach, and T-Mobile settled a 2021 breach for $350 million. In every one of those cases, the company paid without admitting the breach resulted from its own negligence. AT&T’s $177 million deal fits squarely inside that pattern rather than breaking from it.
Why Breach Settlements Keep Landing in the Hundreds of Millions
The size of these settlements tracks roughly with how many people a breach touches and how sensitive the exposed data is. Call records and account metadata, the kind at the center of the AT&T breaches, sit in a gray zone: not as immediately damaging as exposed Social Security numbers, but valuable enough to attackers and privacy-sensitive enough to customers that courts have consistently found real harm worth compensating. Breaches involving direct SSN exposure, like the recent case where a law firm breach exposed Social Security numbers tied to a small group of clients or the larger Zizzl LLC breach affecting 519 people’s SSNs, tend to produce higher per-person damages even when the total claimant pool is far smaller than AT&T’s.
Scale works against individual payouts even as it drives up the headline settlement figure. A fund of $28 million sounds substantial until it is divided across millions of AT&T 2 claimants, which is exactly how tier payments end up in the single digits rather than the thousands for most people without documented losses.
How AT&T’s Deal Compares to Other Major Breach Settlements
| Company | Breach Year | Settlement Value | Settlement Year |
|---|---|---|---|
| Equifax | 2017 | Up to $425 million | 2019 |
| T-Mobile | 2021 | $350 million | 2022 |
| AT&T (combined) | 2024 | $177 million | 2026 |
| Capital One | 2019 | $190 million | 2022 |
| Yahoo | 2016 | $117.5 million | 2019 |
| CT medical provider breach | 2024 | $2.7 million | 2026 |
AT&T’s combined $177 million lands in the middle of that pack, smaller than Equifax or T-Mobile but far larger than mid-size regional breaches like the Connecticut medical provider case. It also took roughly two years from breach disclosure to final settlement approval, which lines up with the typical timeline across this group, none of which resolved in under 18 months.
Market and Industry Impact: Cyber Insurance, Compliance Costs, and Investor Risk
A $177 million settlement, even spread across two years and absorbed by a company of AT&T’s size, feeds directly into how cyber insurers price risk for telecom carriers going forward. Insurers underwriting breach liability coverage use settlements like this one as data points when setting premiums for the next policy cycle, and a nine-figure telecom settlement tends to push those premiums up industry-wide, not just for the company involved. That cost eventually filters down into how much carriers budget for security operations, breach response retainers, and legal defense funds.
There is also a compliance angle. State attorneys general and regulators watching this case will note both the size of the fund and the structure, two breaches bundled into one settlement with separate payout tiers, as a workable template for future multi-incident litigation. Companies facing more than one disclosed breach in a short window, which is increasingly common as attackers run multiple campaigns against the same target, may now have a clearer precedent for how courts expect those cases to be resolved jointly rather than through separate, competing lawsuits.
Competitive Comparison: How Other 2026 Breach Cases Are Playing Out
AT&T is far from the only large organization working through breach fallout in 2026. The Florida Highway Safety and Motor Vehicles agency confirmed its own breach in September and has been mailing notification letters with roughly $1 million in identity-protection coverage attached, a far smaller remediation budget than AT&T’s settlement fund but one serving a narrower, state-level population rather than a national customer base. Overseas, Denmark’s civil registration system disclosed a breach affecting 8.8 million people, and the UK’s Legal Aid Agency is still working through fallout from a breach that ultimately traced records back to 1978, now covering roughly 250,000 victims with guidance on what recourse they actually have.
What separates AT&T’s case from most of these is that it has already reached final settlement approval and a working payout structure, while several of the others are still in notification or early investigation phases. That puts AT&T roughly 18 to 24 months ahead of where agencies like Florida’s DMV or the UK’s Legal Aid Agency currently sit in their own breach timelines, assuming those cases eventually produce comparable settlements.
The Verification Problem in Breach Settlement Reporting
One detail worth flagging plainly: coverage of this settlement is not fully consistent across outlets, starting with the judge’s identity. That kind of discrepancy is common in fast-moving breach settlement coverage, where multiple outlets rewrite the same underlying court filing or settlement-site update within hours of each other, and small factual errors propagate before anyone checks the original docket. Readers trying to verify their own eligibility or payout tier should treat the settlement administrator’s official website and the actual court docket in the Northern District of Texas as the authoritative sources, not secondary news coverage, however widely it has been republished.
This is a broader pattern across breach litigation coverage generally. Settlement figures, payout tiers, and legal fee percentages often get reported accurately at the source and then drift slightly as they get summarized and re-summarized across dozens of outlets chasing the same search traffic.
What Comes Next: 5 Predictions for Breach Litigation in 2027
- Expect more companies facing multiple disclosed breaches within a short window to push for consolidated settlements like AT&T’s two-fund structure, rather than fighting parallel lawsuits separately.
- Attorney fee ratios near a third of total settlement value, as seen in the $59 million AT&T fee award, will draw sharper objections in future cases as plaintiffs’ bars face more public scrutiny over fee proportionality.
- Per-claimant payouts will keep shrinking in large-population breaches as claimant pools grow faster than settlement funds, pushing more mass breach payouts into the single-digit-to-low-double-digit dollar range for undocumented-loss tiers.
- State-level breaches like Florida’s DMV incident and UK’s Legal Aid Agency case will likely take 18 to 24 months to reach a settlement stage comparable to where AT&T stands today.
- Expect regulators to lean harder on mandatory, shorter notification windows following criticism of the gap between breach disclosure and final settlement relief in cases like this one.
Frequently Asked Questions
What is the AT&T $177 million data breach settlement?
It is a court-approved settlement resolving litigation over two separate AT&T data breaches disclosed in 2024, combining a $149 million fund for the first incident (AT&T 1) and a $28 million fund for the second (AT&T 2).
How much money can I get from the AT&T settlement?
Eligible claimants with documented losses can receive up to $5,000 from the AT&T 1 fund and up to $2,500 from the AT&T 2 fund, for a combined maximum of $7,500 if affected by both breaches. Most claimants without documented losses will receive a much smaller flat payment.
Can I still file a claim?
No. The deadline to submit a valid claim was December 18, 2025. Only people who filed by that date are eligible for payment now that the settlement has final approval.
Which AT&T breaches does this settlement cover?
It covers two separate 2024 incidents referred to in court documents as AT&T 1 and AT&T 2, each with its own fund and payout tier structure.
Did AT&T admit fault?
No. AT&T agreed to settle without admitting wrongdoing, which is standard practice in corporate data breach litigation.
When did the settlement get final approval?
October 2, 2026, according to the settlement website as reported by multiple outlets covering the ruling.
How much are the attorneys getting paid?
Reports tied to the settlement approval cite $59 million in attorney fees, roughly a third of the total $177 million fund.
Where can I check my claim status?
Claimants should use the official settlement administrator’s website rather than relying on news coverage, since that site holds the authoritative record of claim status and payment timelines.