AT&T to pay $177 million in data breach settlement affecting 109 million customers

A U.S. judge granted preliminary approval on Friday to a $177-million settlement that resolves lawsuits against AT&T T.N over breaches in 2024 that exposed personal information belonging to tens of millions of the telecom company's customers.
U.S. District Judge Ada Brown in Dallas said in a ruling that the class-action settlement was fair and reasonable.
The deal resolves claims over data breaches that AT&T announced in May and July last year. Depending on which breach is involved, AT&T has agreed to pay up to $2,500 or $5,000 to customers who suffered losses that are "fairly traceable" to the incidents. After payments are made for direct losses, the remaining funds will be distributed to customers whose personal information was accessed.
In case you missed it: T-Mobile cyberattack settlement payments up to $25K delayed
AT&T said it denied allegations it was "responsible for these criminal acts."
"We have agreed to this settlement to avoid the expense and uncertainty of protracted litigation."
AT&T said it expects the settlement will be approved by the end of 2025, with settlement payments to be issued early next year.
One of the incidents resulted in the illegal downloading of about 109 million customer accounts at the U.S. wireless company. AT&T disclosed that its call logs were copied from its workspace on a Snowflake SNOW.N cloud platform covering about six months of customer call and text data from 2022 from nearly all its customers.
In March 2024, AT&T said it was investigating a data set released on the "dark web" and said its preliminary analysis showed it affected approximately 7.6 million current account holders and 65.4 million former account holders. The company said the data set appeared to be from 2019 or earlier.
The Federal Communications Commission is also investigating. In September, AT&T agreed to pay $13 million to resolve an FCC investigation over a data breach of a cloud vendor in January 2023 that impacted 8.9 million AT&T wireless customers.
The FCC said the data exposed in 2023 covered customers from 2015 through 2017 that should have been deleted in 2017 or 2018.
Reporting by Mike Scarcella and David Shepardson; Editing by Mark Porter, Leslie Adler and Rod Nickel

Try Our AI Features

Explore what Daily8 AI can do for you:

Learn with AIFact CheckingText to SpeechAI Summary

Related Articles

Yahoo

5 hours ago

• Yahoo

AT&T's $177-million data breach settlement wins US court approval

By Mike Scarcella and David Shepardson WASHINGTON (Reuters) -A U.S. judge granted preliminary approval on Friday to a $177-million settlement that resolves lawsuits against AT&T over breaches in 2024 that exposed personal information belonging to tens of millions of the telecom company's customers. U.S. District Judge Ada Brown in Dallas said in a ruling that the class-action settlement was fair and reasonable. The deal resolves claims over data breaches that AT&T announced in May and July last year. Depending on which breach is involved, AT&T has agreed to pay up to $2,500 or $5,000 to customers who suffered losses that are "fairly traceable" to the incidents. After payments are made for direct losses, the remaining funds will be distributed to customers whose personal information was accessed. AT&T said it denied allegations it was "responsible for these criminal acts." "We have agreed to this settlement to avoid the expense and uncertainty of protracted litigation." AT&T said it expects the settlement will be approved by the end of 2025, with settlement payments to be issued early next year. One of the incidents resulted in the illegal downloading of about 109 million customer accounts at the U.S. wireless company. AT&T disclosed that its call logs were copied from its workspace on a Snowflake cloud platform covering about six months of customer call and text data from 2022 from nearly all its customers. In March 2024, AT&T said it was investigating a data set released on the "dark web" and said its preliminary analysis showed it affected approximately 7.6 million current account holders and 65.4 million former account holders. The company said the data set appeared to be from 2019 or earlier. The Federal Communications Commission is also investigating. In September, AT&T agreed to pay $13 million to resolve an FCC investigation over a data breach of a cloud vendor in January 2023 that impacted 8.9 million AT&T wireless customers. The FCC said the data exposed in 2023 covered customers from 2015 through 2017 that should have been deleted in 2017 or 2018.

Business Insider

6 hours ago

• Business Insider

Morgan Stanley Sticks to Their Hold Rating for T&D Holdings (TDHOF)

Morgan Stanley analyst Atsuro Takemura maintained a Hold rating on T&D Holdings (TDHOF – Research Report) yesterday and set a price target of Yen3,420.00. The company's shares closed last Friday at $21.57. Confident Investing Starts Here: Easily unpack a company's performance with TipRanks' new KPI Data for smart investment decisions Receive undervalued, market resilient stocks right to your inbox with TipRanks' Smart Value Newsletter According to TipRanks, Takemura is a 2-star analyst with an average return of 7.2% and a 50.00% success rate. T&D Holdings has an analyst consensus of Moderate Buy, with a price target consensus of $28.41. TDHOF market cap is currently $11.37B and has a P/E ratio of 14.30.

Travel + Leisure

17 hours ago

• Travel + Leisure

The TSA Warns Against 'Juice Jacking' at the Airport—Here's How to Protect Yourself

When was the last time you used a USB charging station at the airport? According to the Transportation Security Administration, you should think twice before charging your phone at one of those stations. "Hackers can install malware at USB ports (we've been told that's called 'juice/port jacking')," the TSA recently advised travelers on Facebook. "So, when you're at an airport, do not plug your phone directly into a USB port. Bring your TSA-compliant power brick or battery pack and plug in there." The warning has sparked fresh concern about "juice jacking," a cyberattack where criminals install malware on public charging stations to steal data from connected devices. But how real is this threat for everyday travelers? We asked a few experts. A person using their tablet. Margot Cavin/Travel + Leisure According to Calum Baird, a digital forensics expert, juice jacking is more theoretical than anything else. Despite the alarming warnings circulating online, Baird says he hasn't encountered any actual cases in his professional experience. "I see it pop up online every now and then, but most, if not all, modern smartphones now require confirmation prior to data transfer via USB," Baird says. Baird notes that even if travelers encounter compromised charging stations, most modern devices have built-in protections. Baird's personal experiences are also backed by the Federal Communications Commission, and on its website, the organization states that although it is technically possible, the FCC is not aware of any confirmed cases of juice jacking. Plugging into a USB charging port. Danny Jenkins, cofounder and CEO of ThreatLocker, offers another perspective on what travelers should actually worry about, and points to an unexpected source: deceptive USB-C cables. "Shady USB-C cables likely pose the greater risk, partly because the dangers of public charging ports are more widely known," he says. Jenkins says that people have become more aware of the dangers associated with public charging stations, so they're more cautious about using them. However, many travelers don't think twice about buying a cheap charging cable from a questionable vendor at an airport shop or online marketplace, making these cables a more successful point of attack. "Attackers are always searching for new exploits," he says. "While upcoming measures may mitigate issues related to juice jacking, vulnerabilities could still emerge as attackers gain access to new USB technologies and attempt to bypass these protections." A person plugging in a phone. Margot Cavin/Travel + Leisure While it's hard to find reports of actual juice jacking cases, it's always a good idea to take extra precautions, just in case. Jenkins says that portable battery packs can help mitigate the chances of a juice-jacking attack. If you don't have any other options aside from a public charging station, Jenkins recommends checking for signs of tampering on the USB port area. Baird says to check your phone as you plug it in. 'If it's asking you to trust a device you've connected to, decline,' he says. 'It doesn't need data transfer to charge.' While juice jacking remains largely theoretical, the TSA's cautious approach makes sense given the high-traffic nature of airports and the valuable data stored on travelers' devices. However, modern smartphones have built-in protections, and a few simple precautions can drastically eliminate any risk. Instead of avoiding public charging entirely, travelers can stay safe by bringing their own charging equipment, paying attention to device prompts, and being selective about where they source cables and adapters. After all, a dead phone battery poses a more immediate risk than juice jacking for most travelers.