AT&T data breach: what happened and what to do

If you have had an AT&T account, you may have seen headlines about a data breach. There were actually two separate incidents in 2024, and they are easy to mix up. This page keeps them apart, using what AT&T, the SEC filing and the official settlement site say.

What was made public

According to the official settlement website, the two incidents are called "AT&T 1" and "AT&T 2."

AT&T 1. On March 30, 2024, AT&T announced that AT&T-specific fields were contained in a data set released on the dark web. Lawsuits followed in state and federal courts and were consolidated in June 2024 before a federal judge in the Northern District of Texas.

AT&T 2. On July 12, 2024, AT&T announced that certain limited data had been illegally downloaded from an AT&T workspace on a third-party cloud platform. The settlement site says that platform was hosted by Snowflake, Inc.

AT&T described the second incident in a Form 8-K filed with the SEC on July 12, 2024. According to that filing, AT&T learned on April 19, 2024 that a threat actor claimed to have accessed and copied its call logs. The filing says files were taken between April 14 and April 25, 2024. AT&T also said it is working with law enforcement and that at least one person has been apprehended.

In a July 31, 2024 letter to SEC staff, AT&T said the U.S. Department of Justice determined on May 9 and again on June 5, 2024 that a delay in public disclosure was warranted. That explains why the July announcement came months after the April discovery.

The settlement site says the parties settled without any admission of liability or wrongdoing.

Who may be affected and how to find out

The settlement site defines two groups of people.

The AT&T 1 group covers living people in the United States whose data was included in the March 2024 incident. The AT&T 2 group covers AT&T account owners, lines or end users whose data was involved in the July 2024 incident. The Form 8-K says the July incident involved "nearly all" of AT&T's wireless customers, plus customers of mobile virtual network operators that use AT&T's network.

AT&T said in the filing that it would notify current and former customers who were affected. The safest way to check is through channels you already know are real. Sign in to your AT&T account on the company's own website or app, or call the number printed on your bill. AT&T's support page on the settlement also points people to the settlement administrator, Kroll Settlement Administration, at (833) 890-4930.

Do not use links from an email or text that arrives out of the blue. Scammers often write right after a breach is in the news.

What data was exposed

The two incidents involved different kinds of data.

For AT&T 1, the settlement site lists these data elements: some combination of names, addresses, telephone numbers, email addresses, dates of birth, account passcodes, billing account numbers and Social Security numbers. The mix varied by person.

For AT&T 2, the Form 8-K describes records of customer calls and texts. That covers which phone numbers a customer interacted with, how many interactions there were, and the total call time for a day or month. For a small subset of records, it also includes one or more cell site identification numbers.

According to the filing, the July data does not contain the content of calls or texts. It does not contain Social Security numbers, dates of birth or other personal information. The filing also notes that it does not include customer names, though publicly available online tools can sometimes link a phone number to a name.

Call patterns can still be sensitive. Who you call, and how often, can say something about your life. That is a reason to be careful about unexpected contact, not a reason to panic.

What to do now

You cannot undo a breach, but you can lower the chance that exposed details are misused.

Change your AT&T account passcode and password. If you reuse them anywhere else, change those too. A password manager makes unique passwords easier. Turn on multi-factor authentication where it is offered. The FTC says it makes it harder for scammers to log in to your accounts if they do get your username and password.

Think about a credit freeze. According to the FTC, a freeze is free. You place it with each of the three credit bureaus: Equifax, Experian and TransUnion. It stays in place until you lift it, and you can lift it temporarily when you apply for credit. The FTC also describes fraud alerts, which are free too. An initial fraud alert lasts one year and can be renewed. These are options, not requirements. What fits depends on your situation.

Read your statements. Look at bank, card and phone statements, and at your credit reports, for activity you do not recognize. If you find signs of identity theft, the FTC points people to IdentityTheft.gov for next steps.

Expect phishing and text scams. The FTC says scam messages often claim a problem with your account or ask you to confirm personal details. If you have an account with the company, contact it using a phone number or website you know is real, not the contact details in the message. To report phishing texts, the FTC says to forward them to 7726 (SPAM). You can report any scam to the FTC at ReportFraud.ftc.gov.

Be careful with calls about your account. Because the July data is about phone numbers and calls, treat unexpected callers who seem to know a lot about you with caution. Hang up and call the company back on a number you trust.

The settlement: what the official site says

The official settlement website is the place to check, because details change. Its most recent update, dated October 30, 2026, says the court granted final approval of the settlement on October 2, 2026. It also says payments have not been issued, because payments cannot be made until the settlement becomes "effective," which happens after the time to appeal has ended and any post-judgment motions or appeals are resolved. The site says payments are not expected to be issued in 2026.

The site also states that claims can no longer be submitted. The claim deadline was December 18, 2025, and the deadline to opt out or object was November 17, 2025. The site says that if you submitted a valid claim, you do not need to do anything else, and that updates will be posted there.

This is a summary of what the site says, not legal advice, and it does not promise any payment to anyone. Amounts depend on the claims process and court decisions. AT&T's own support page says it is not managing the settlement and that Kroll is the court-appointed administrator. Dates and status can change, so read the official site yourself.

Check whether your email shows up in known breaches

A free scan can show whether your email address appears in known data breaches, using public sources such as Have I Been Pwned and LeakCheck. It does not detect these AT&T incidents specifically, and a clean result does not mean your data was never exposed. It is simply a quick way to see which of your accounts may deserve a new password.