AT&T $177 Million Data Breach Settlement Gets Final Approval, Payout Estimates, Claim Status and What Happens Next

On October 2, 2026, Senior U.S. District Judge Sidney A. Fitzwater granted final approval to AT&T’s $177 million class action settlement over two 2024 data security incidents. The order is a 73-page memorandum opinion in In re: AT&T Inc. Customer Data Security Breach Litigation, MDL No. 3114 (N.D. Tex., Dallas Division).

• The claim deadline has passed. It was December 18, 2025. No new claims are being accepted.
• Most people with valid claims should expect small payments. The administrator’s estimates in the court record range from about $6.50 to $40, depending on the tier. Only claimants who proved real out-of-pocket losses can receive more, up to $5,000 (first incident) or $2,500 (second incident).
• No payment date has been announced. The agreement requires payment within 60 days after the “Effective Date,” which comes only after the approval is final and any appeal is resolved.
• AT&T did not admit wrongdoing.

Settlement at a Glance

Detail	What the record shows
Total settlement	$177,000,000, all cash and non-reversionary (no money returns to AT&T)
AT&T 1 fund	$149,000,000 (incident announced March 30, 2024)
AT&T 2 fund	$28,000,000 (incident announced July 12, 2024)
Court	U.S. District Court, Northern District of Texas, Dallas Division
Case numbers	Civil Action No. 3:24-CV-00757-E; MDL No. 3:24-md-03114
Judge	Senior Judge Sidney A. Fitzwater (case reassigned to him August 17, 2026)
Final approval	October 2, 2026 (ECF No. 85)
Settlement administrator	Kroll Settlement Administration LLC
Lead class counsel	W. Mark Lanier (Lanier Law Firm), with an executive committee including Seeger Weiss, Carella Byrne, Morgan & Morgan and Modjarrad Abusaad & Said
Documented-loss maximums	Up to $5,000 (AT&T 1); up to $2,500 (AT&T 2)
Estimated tier payments	Roughly $6.50 to $40 per approved claim
Opt-out and objection deadline	November 17, 2025 (passed)
Claim deadline	December 18, 2025 (passed)
Payment date	Not announced
Official website	telecomdatasettlement.com
Administrator phone	(833) 890-4930

When Will AT&T Settlement Payments Be Sent?

The honest answer is: not yet known.

The settlement agreement says benefits must be paid electronically or by paper check within 60 days after the Effective Date. The Effective Date depends on the agreement’s conditions, including when the court’s judgment becomes final. In federal civil cases, a notice of appeal is generally due within 30 days after entry of judgment (Fed. R. App. P. 4(a)(1)(A)). Several objectors raised issues the court said could be raised on appeal, so a challenge is possible, and an appeal would delay payments.

News outlets have suggested payments could begin in late November or December if nothing slows the process. That is a forecast, not a deadline. Do not rely on any website that gives you an exact payout date. The court order simply directs Kroll to distribute benefits on the timeline in the settlement agreement.

How Much Will Claimants Receive?

Estimated tier payments

The court’s order quotes Kroll’s estimates, which depend on the final number of valid claims and the money left after deductions:

Tier (as labeled in the order)	Estimated payment
AT&T 1, Tier 1 (SSN-related exposure)	$39 to $40
Tier 2	$7.50 to $8.10
AT&T 2, Tier 3	$6.50 to $7.10

A note on labels: the order lists Tier 2 under the AT&T 2 fund, while some settlement-site descriptions have grouped Tier 2 with AT&T 1. If you filed a claim, confirm your tier with Kroll rather than relying on a news summary. These are estimates, not guaranteed amounts.

The court explained that people with documented losses are paid first. Tiered cash payments for people without documented losses come afterward and scale up for more sensitive data, such as Social Security numbers.

Documented-loss payments

Claimants who submitted valid proof of losses “fairly traceable” to a breach could receive:

• Up to $5,000 for AT&T 1.
• Up to $2,500 for AT&T 2.

People in both classes (“Overlap Members”) could claim from both funds, with limits meant to prevent being paid twice for the same loss. Together that makes a theoretical ceiling of $7,500. That is a cap, not a typical payment. The court noted that documented-loss claims in AT&T 2 were large compared with its $28 million fund, and it found that Tier 3 claimants would still receive roughly $6.50 to $7.10.

Why the headline number is not what gets divided

The $177 million is reduced before payments are made:

• Attorneys’ fees: Class counsel asked for one-third of each fund, $59 million in total ($49.67 million from AT&T 1 and $9.33 million from AT&T 2). The court approved the fee awards, along with litigation costs and service awards for the 36 class representatives, according to reports of the order.
• Administration costs: Kroll’s original estimate was about $5.45 million. The cost estimate has grown to roughly $22.16 million. The judge approved $18,856,175.48 already billed and reserved judgment on the rest, noting that every dollar spent on administration is one less dollar for class members.

How Many Claims Were Filed, and Why Were So Many Rejected?

As of August 24, 2026, Kroll reported to the court:

Claim data	Number
Total claim forms received	4,918,073 (754,263 paper; 4,163,810 electronic)
Allowed, Tier 1	1,654,046
Allowed, Tier 2	687,859
Allowed, Tier 3	1,582,248
Rejected (late, duplicate, fraud, released, withdrawn or ineligible business)	1,099,732
Of the rejected, declined for fraud	804,381 (about 16% of all claims)
Overall claims rate	About 4.8% of 99,763,302 notice records

The court said these numbers may change as deficient claims are resolved. They count claim forms, not unique people.

The fraud-screening process

The fraud review was done by ClaimScore LLC (doing business as Covalynt), not by Kroll. Counsel for both sides vetted the method, and the court found it provided reasonable protection against fraudulent claims. To protect legitimate claimants, a court-appointed Special Master, retired U.S. District Judge Royal Furgeson, helped set up a notice-and-cure process:

1. Kroll emails the claimant that the claim was flagged.
2. The claimant prints and completes a Validation Form and signs it in ink.
3. The signed form must be mailed to Kroll, postmarked within 21 days of the notice email, one form per envelope.

A fraud flag in this process is an administrative decision. It is not a criminal finding against anyone.

What the Two Data Incidents Involved

AT&T 1 (announced March 30, 2024)

According to the complaint described in the order, a third party compromised AT&T systems in 2019. The data set appeared on the dark web on or before August 20, 2021, and AT&T announced the incident almost three years later. Depending on the person, the data included some combination of names, addresses, phone numbers, emails, dates of birth, account passcodes, billing account numbers and Social Security numbers. About 57 million records were AT&T 1 only.

AT&T 2 (announced July 12, 2024)

This incident involved data downloaded from AT&T’s workspace on a third-party cloud platform run by Snowflake. It included phone numbers of current and former customers, the numbers they interacted with, interaction counts, aggregate call durations and, for a small subset, cell-site IDs. The court stated it did not include call or text content, names, Social Security numbers or dates of birth. About 36 million records were AT&T 2 only, and about 6.3 million people were in both classes.

In total, the notice list had 99,763,302 class member records.

Who Was in the Settlement Classes?

• AT&T 1 Class: Living people in the United States whose AT&T 1 data elements were involved in the first incident.
• AT&T 2 Class: AT&T account owners, line users or end users whose AT&T 2 data elements were involved in the second incident.

Excluded were AT&T and its affiliates, judges and their families, anyone who already released claims, and anyone who timely opted out. The court certified both classes for settlement purposes only under Federal Rule of Civil Procedure 23(b)(3). That is not a finding that AT&T broke the law.

What Claims Did the Lawsuit Raise?

The master complaint alleged violations of the Communications Act, the Satellite Home Viewer Extension and Reauthorization Act and the Cable Television Consumer Protection and Competition Act, plus negligence, breach of implied contract and declaratory and injunctive relief. AT&T denied wrongdoing. The settlement ends those claims for class members who did not opt out, without a trial or a ruling on liability.

How the Judge Decided the Settlement Was Fair

Federal Rule of Civil Procedure 23(e)(2) allows a court to approve a class settlement only if it is fair, reasonable and adequate. In the Fifth Circuit, judges also apply the six Reed v. General Motors factors. Judge Fitzwater found that every factor favored approval. His key reasoning:

• Litigation risk was real. AT&T could have challenged Article III standing (see TransUnion LLC v. Ramirez, 2021), moved to compel individual arbitration under its customer agreement (see AT&T Mobility v. Concepcion, 2011) and contested liability and damages. The court noted the law on data breach claims is still developing.
• The deal was negotiated at arm’s length. A mediator led talks in March 2025, and a single agreement was signed on May 30, 2025. The court rejected claims of a “reverse auction” and found no sign of collusion.
• Notice was adequate. Direct notice likely reached about 87% of records, and notice plus media reached an estimated 90%.
• The amount was reasonable. Objectors compared the deal to T-Mobile’s $350 million settlement, which had a $25,000 documented-loss cap and two years of credit monitoring. The court said headline comparisons are not a substitute for the Rule 23 analysis and pointed to other approved data breach settlements.
• Participation and opposition were modest. About 45 objectors filed, and 10,741 opt-out requests were received, many late or non-compliant.

Objections the court rejected

The court overruled objections on adequacy of the amount, arbitration rights (class members who wanted arbitration could opt out), judicial estoppel, the lack of credit monitoring, predominance and state-law variation, the “fairly traceable” proof standard, releases (including the release of Snowflake), security-upgrade commitments and the injunction against parallel proceedings.

Opt-outs

The court approved 494 compliant opt-outs and 2,332 opt-outs submitted through Harrer Law and Potter Handy. It rejected 6,802 opt-outs that were late or non-compliant, including 5,999 filed with electronic signatures instead of the required ink signature. Those people remain bound by the settlement. People who validly opted out keep the right to pursue individual claims, which may have to go to arbitration.

Leftover money

The one objection the court sustained involved leftover funds. The proposed recipient of leftover money was the Texas Bar Foundation. The court found its link to data breach victims indirect and ordered a modified process:

1. Kroll and the parties must report any residual funds.
2. Leftover money must first be considered for additional payments to claimants if that is economically feasible and practical.
3. Only if that is not feasible may a cy pres donation be made, and the recipient must have a substantial connection to data privacy, cybersecurity, consumer protection or access to justice.

What Should Claimants Do Now?

1. Check your status on the official website or by calling (833) 890-4930.
2. Respond to any Kroll notice. If you were flagged and received a cure notice, the 21-day window runs from the date of that email.
3. Keep your contact and payment details current with Kroll.
4. Do not file a “new” claim. The deadline closed on December 18, 2025.
5. Watch for scams. Legitimate settlement payments do not require you to pay a fee, buy gift cards or share bank logins. Use only the official website or the phone number above.

Administrator contact: AT&T Data Incident Settlement, c/o Kroll Settlement Administration LLC, P.O. Box 5324, New York, NY 10150-5324.

Are the Payments Taxable?

Settlement money is generally taxable income unless it reimburses a loss you did not already deduct or compensates for physical injury. A typical tier payment in a data breach case is treated as ordinary income by many taxpayers. The rules depend on your situation, so ask a qualified tax professional.

Key Dates

Date	Event
March 30, 2024	AT&T announces the first incident
June 5, 2024	JPML centralizes the AT&T 1 cases in the Northern District of Texas
July 12, 2024	AT&T announces the second (Snowflake) incident
March 17-19, 2025	Mediated settlement talks
May 30, 2025	Settlement agreement signed
June 20, 2025	Preliminary approval granted
Nov. 17, 2025	Opt-out and objection deadline
Dec. 18, 2025	Claim deadline
Jan. 15, 2026	Final approval hearing
Aug. 14-17, 2026	Original judge recuses; case reassigned to Judge Fitzwater
Oct. 2, 2026	Final approval order
Not yet announced	Payment date, 60 days after the Effective Date

Related Guides on AllAboutLawyer.com

• Nelnet $10 Million Data Breach Settlement: Payout Date and Status
• WebTPA Data Breach Settlement Approved: $13.75 Million for 2.4 Million Victims
• Brightspeed Data Breach Lawsuit: Are You One of 1 Million Customers Whose Data Was Stolen?

Sources

1. Memorandum Opinion and Order, In re: AT&T Inc. Customer Data Security Breach Litigation, No. 3:24-md-03114 (N.D. Tex. Oct. 2, 2026) (ECF No. 85): https://www.govinfo.gov/content/pkg/USCOURTS-txnd-3_24-md-03114/pdf/USCOURTS-txnd-3_24-md-03114-0.pdf
2. Official settlement website (Kroll): https://www.telecomdatasettlement.com
3. Fed. R. Civ. P. 23: https://www.law.cornell.edu/rules/frcp/rule_23
4. Class Action Fairness Act notice, 28 U.S.C. § 1715: https://www.law.cornell.edu/uscode/text/28/1715
5. Fed. R. App. P. 4(a)(1)(A): https://www.law.cornell.edu/rules/frap/rule_4
6. Reed v. General Motors Corp., 703 F.2d 170 (5th Cir. 1983); Phillips Petroleum Co. v. Shutts, 472 U.S. 797 (1985); TransUnion LLC v. Ramirez, 594 U.S. 413 (2021); AT&T Mobility LLC v. Concepcion, 563 U.S. 333 (2011)

Disclaimer: This article offers general information about a public court record and is not legal or tax advice. Estimates are from the administrator’s declarations and may change. Contact Kroll or a licensed attorney about your individual claim.

By Israr Ahmad, Legal Content Researcher, AllAboutLawyer.com. Last updated October 22, 2026. This is legal information, not legal advice. The author is not an attorney.