The AT&T class action settlement payout is capped at $5,000 for customers whose Social Security numbers and other personal data were exposed in the March 2024 dark-web breach, and at $2,500 for customers whose call and text records were stolen in the July 2024 Snowflake-related breach. Both caps require documented financial losses tied to the breach; customers without documentation receive a pro rata share of whatever remains in each fund. The total settlement is $177 million, split into a $149 million fund for the first breach and a $28 million fund for the second. No money has been distributed. The court held its final approval hearing on January 15, 2026, and as of an April 23, 2026 update from the settlement administrator, no ruling had been issued.
What Each Class Member Can Receive
The March 2024 Breach Fund ($149 Million)
This fund covers roughly 73 million current and former account holders whose data surfaced on the dark web, including names, addresses, phone numbers, email addresses, dates of birth, account passcodes, billing account numbers, and Social Security numbers. Payments are structured in tiers.
If you can document financial harm fairly traceable to the breach that occurred in 2019 or later, you can claim up to $5,000. Acceptable proof includes receipts, bank statements, and credit-monitoring fees.
If you cannot document losses but your Social Security number was among the exposed data, you fall into Tier 1 and receive a pro rata share of what remains after documented-loss claims, administration costs, and attorney fees come out. Tier 1 payments are set at five times the Tier 2 amount.
If your other personal information was exposed but your Social Security number was not, you fall into Tier 2 and receive a smaller pro rata share of the remaining fund.
The July 2024 Breach Fund ($28 Million)
This fund covers the theft of call and text records from an AT&T workspace hosted on Snowflake. The stolen data included phone numbers, the numbers customers interacted with, how often they communicated, aggregate call durations, and, for a small group, cell site identification numbers that could approximate location. Names, Social Security numbers, and message content were not part of this breach. The affected pool is larger than the first breach, reaching nearly 109 million U.S. customers according to security researchers.
Account owners who can document losses occurring on or after April 14, 2024 may claim up to $2,500. Account owners can also submit claims on behalf of their authorized line users or end users. Everyone else eligible for this fund receives a pro rata share of what is left.
If You Were in Both Breaches
Customers hit by both incidents qualify as “overlap settlement class members” and may file a separate claim against each fund. The theoretical maximum for someone in both classes with fully documented losses is $7,500. Actual payments depend on how many claims are filed and how much remains in each fund after administrative and legal costs.
The Claim Deadline Has Passed
The deadline to file was December 18, 2025, extended from an earlier November 18, 2025 date. The official settlement website is www.telecomdatasettlement.com, administered by Kroll Settlement Administration LLC. Claims could be filed online or mailed to:
AT&T Data Incident Settlement
c/o Kroll Settlement Administration LLC
P.O. Box 5324
New York, NY 10150-5324
Filing online required a Class Member ID from the email or postcard notice sent starting in August 2025, plus an email address, AT&T account number, or full name for verification. Supporting documentation and payment details, including direct deposit information, were submitted through the site. If you never received a notice, notices came from “Kroll Settlement Administration LLC” or attsettlement@e.emailksa.com; the settlement hotline is (833) 890-4930.
When Payments Will Go Out
Judge Ada Brown of the Northern District of Texas granted preliminary approval on June 20, 2025 and held the final approval hearing on January 15, 2026, rescheduled from December 3, 2025. As of the settlement administrator’s April 23, 2026 update, the court had not yet ruled. Kroll has said it is still reviewing and processing claims and that distributions will begin only after the court grants final approval and any appeals are resolved.
Objectors filed challenges before the October 17, 2025 deadline, and three individuals filed an interlocutory appeal after Judge Brown denied their motion to intervene. That appeal was voluntarily dismissed on October 21, 2025. Any new appeal filed after final approval could further delay distributions.
What Comes Out of the Fund Before You Get Paid
The settlement is entirely monetary. AT&T is not providing credit monitoring, agreeing to any security improvements, or admitting liability.
Plaintiffs’ counsel filed a fee application on November 3, 2025 requesting $59 million, roughly one-third of the total settlement. That breaks down into $49.67 million for the team led by Mark Lanier, which represented the first settlement class, and $9.33 million for the team led by Jeff Ostrow, which represented the second, plus up to $796,230 in combined litigation costs. Those amounts, along with any service awards for the named plaintiffs and the costs of administering claims, come out of the two funds before class members are paid. Because the Tier 1, Tier 2, and no-documentation shares are pro rata, the more the court awards in fees and costs, the smaller each of those shares becomes.
This Is Not the FTC Throttling Refund
The $177 million data breach settlement is separate from an AT&T refund program run by the Federal Trade Commission. That program comes from a 2019 FTC lawsuit alleging AT&T misled unlimited-plan customers by throttling their data speeds, and it produced a $60 million settlement distributed by a different administrator, JND Legal Administration. Receiving a throttling refund does not disqualify you from the data breach settlement, and the two involve entirely different claims. If your notice or payment came from JND rather than Kroll, it belongs to the throttling case, not the breach settlement described here.