AT&T Data Breach Lawsuit Says 73 Million People Impacted by 2024 Cyberattack [UPDATE]

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action lawsuit alleges the massive March 2024 AT&T data breach was a direct result of the telecom giant’s failure to implement industry-standard cybersecurity to protect current and former customers’ sensitive—and valuable—personal information. 

The 51-page AT&T data breach lawsuit says the personal information of 7.6 million current customers and 65.4 million former customers—approximately 73 million people—was stolen by cybercriminals because the company stored the data in a “reckless manner.”  

According to the case, current and former AT&T customers’ full names, addresses, dates of birth, phone numbers, Social Security numbers and AT&T account numbers and passcodes are now in the hands of hackers, who reportedly leaked the data online last month. The suit alleges the consumer data stolen in the AT&T data breach has subsequently been sold on the dark web. 

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

“As a result of the Data Breach, Plaintiff and Class Members have been exposed to a heightened and imminent risk of fraud and identity theft,” the proposed class action lawsuit states. “Plaintiff and Class Members must now and in the future closely monitor their financial accounts to guard against identity theft.” 

In March, the sensitive information of 73 million current and former AT&T customer accounts was leaked online and made available for free, the filing shares. The lawsuit, citing a New York Times report on the AT&T data breach, says that the leaked data first appeared for sale online back in August 2021 but was posted again last month by a different hacker group known as MajorNelson. 

According to another proposed data breach class action lawsuit, AT&T stated in an email notice to data breach victims that the data set “appears to be from 2019 or earlier.” That suit says that when the stolen AT&T data was first leaked publicly in 2021, there was no way to authenticate that the information came from AT&T directly. 

TechCrunch reports that AT&T began a mass reset of customer passcodes after the publication informed the telecom giant last Monday, March 25, that the leaked data “contained encrypted passcodes that could be used to access AT&T customer accounts.” TechCrunch says this is the first time AT&T has acknowledged that the leaked data belongs to its customers, even though a hacker claimed credit for the theft some three years ago.

Are you owed unclaimed settlement money? Check out our class action rebates page full of open class action settlements.

The AT&T data breach case argues that victims have incurred “concrete injuries” as a result of the cyberattack, including an invasion of privacy, the lost or diminished value of their information, and lost time spent mitigating the consequences of the breach. AT&T data breach victims may also incur out-of-pocket costs related to credit monitoring services, credit freezes, credit reports and other services to protect themselves from identity theft and fraud, the suit adds. 

The lawsuit detailed here looks to cover all United States residents whose personally identifiable information was accessed and/or stolen by an unauthorized party as a result of the data breach AT&T announced in March 2024. 

For current and former AT&T customers impacted by the data breach, there’s nothing they need to do at this time to join, sign up for, or add their name to the lawsuit. ClassAction.org will update this page as the lawsuit develops, so be sure to check back often. 

Did you receive an AT&T data breach notice? Let us know here.