AT&T class action: open cases and how to join

The AT&T class actions currently in play

As of 2026, the active AT&T litigation is dominated by two consolidated data-breach cases in the Northern District of Texas. The first stems from a March 2024 disclosure, when AT&T confirmed that a dataset containing names, addresses, Social Security numbers, dates of birth and account information was posted to a hacking forum. AT&T said the leak touched roughly 73 million current and former account holders, with much of the data dating to 2019 or earlier.

The second cluster followed a July 2024 disclosure covering call and text metadata (phone numbers dialed and texted, call counts, and in some cases cell-site information) allegedly exfiltrated from a third-party cloud environment used by AT&T. That incident was reported to affect nearly all AT&T wireless customers during a several-month window in 2022.

Both matters were consolidated into multi-district-style proceedings and, according to court filings reported in the trade press, moved into settlement discussions in 2024–2025. Terms are still being finalized in public dockets, so treat any specific dollar figure you see online with caution until the court posts the notice.

What the lawsuits actually allege

The core claims are typical of modern data-breach suits: negligence, breach of implied contract, and violations of state consumer-protection statutes. Plaintiffs argue AT&T failed to implement reasonable safeguards, delayed notifying customers, and left people exposed to identity theft, SIM-swap fraud, and phishing for years.

The March 2024 case leans on the sensitivity of Social Security numbers — data that doesn't expire and can be reused indefinitely by criminals. The July 2024 case is different: metadata doesn't include the content of calls or texts, but plaintiffs argue that who you called, when, and from where can be just as revealing, especially for journalists, domestic-abuse survivors, and people in sensitive professions.

You don't need to have suffered documented identity theft to be a class member. Courts have repeatedly held that exposure of personally identifiable information can support standing on its own, though documented out-of-pocket losses (freeze fees, fraud losses, time spent) usually unlock larger tiers of compensation. Read what a class action lawsuit is if you're new to the format.

Who's in the class

The class definitions aren't final until the court approves the settlement notice, but based on the pleadings you're likely eligible if any of the following apply. Note that Cricket Wireless customers are typically included because Cricket is an AT&T subsidiary.

How to join (and what "opt out" really means)

Class actions work opposite to how most people expect. If you fit the class definition, you're already in — you don't sign up to join. What you do have to do is file a claim to actually receive money once a settlement is approved. If you take no action, you stay bound by the settlement (meaning you give up the right to sue AT&T separately for the same conduct) but you get nothing.

Opting out is the reverse: you mail a written exclusion request to the administrator by the deadline, keeping your individual right to sue but forfeiting any settlement payout. Most people should not opt out unless they have serious, documented damages and their own attorney. See how a class action works for the full flowchart.

1. Wait for the official notice by email or postal mail from the court-appointed administrator.
2. Verify the notice is real — check the URL against the court's docket or a news report, never click links from unsolicited texts.
3. Complete the claim form online with your claim ID (or the phone number/account number on file).
4. Upload documentation only if you're claiming the documented-loss tier — the base tier requires none.
5. Choose your payment method (ACH, check, digital card) and submit before the deadline.
6. Save the confirmation number and check back in 6–18 months; final approval hearings often delay payment.

What you can realistically expect to be paid

Nothing is guaranteed until the court approves the deal, but historical data-breach settlements set a reasonable range. Base cash tiers with no proof usually land between $25 and $150 per class member. Documented-loss tiers — where you can show receipts for credit-monitoring you paid for, freeze/unfreeze fees, fraud losses, or reasonable time spent at an hourly rate — often cap in the hundreds to low thousands.

The wildcard is claim rate. If only 3–5% of the class files (typical for large consumer breaches), per-person payouts skew higher because unclaimed money often redistributes to filers via a pro-rata bump. If claim rates spike because of viral coverage, per-person payouts shrink. See how much no-proof settlements typically pay for the full breakdown.

Also expect the fund to be reduced by attorneys' fees (commonly 25–33%), administration costs, and named-plaintiff service awards before per-person math happens. That's normal and disclosed in every notice.

How to spot fake AT&T settlement emails

Any high-profile breach spawns a scam wave. Real settlement administrators do a few things and don't do others, and knowing the pattern will save you from handing your identity to a second attacker.

• Real notices never ask for your Social Security number in full to "verify" a claim. They ask for a claim ID, last four of SSN, or your account number — never the whole SSN plus a bank login.
• Real administrators are court-appointed firms like Kroll, Epiq, Angeion, JND, or Rust Consulting. If the sender's domain isn't one of those (or the case-specific site linked from the court docket), treat it as phishing.
• Real payouts don't require you to pay a "processing fee" or buy gift cards. Ever.
• Real deadlines are months out, not "file in the next 24 hours or forfeit." Urgency is a scam tell.

When in doubt, go find the case yourself on the settlements directory or on classaction.org rather than clicking a link in the message.

How to make sure you don't miss the claim window

The single biggest reason people leave settlement money on the table isn't ineligibility — it's missing the deadline. Claim windows for large data-breach cases typically stay open 90 to 180 days after final approval, and administrators mail notices to the address on file at the time of the breach, which may be years out of date.

Three things dramatically improve your odds of collecting. First, keep the email on your AT&T account current so the administrator can reach you. Second, bookmark the case's official settlement site once it's live and set a calendar reminder for two weeks before the deadline. Third, use a monitoring service — Owed tracks certified settlements across the major administrators and pings you when a case matches accounts you've had.

If you want a broader sweep, see how to find open class action settlements and how to check if you're part of one. This isn't legal advice — for individualized questions, especially if you had significant identity-theft losses, talk to a consumer-protection attorney in your state.

Glossary

Class member

A person who fits the court-approved definition of who was harmed by the defendant's conduct.

Administrator

The court-appointed third-party firm that handles notices, claim forms, and payments — not the law firm.

Opt out

A written request to be excluded from the class, preserving your right to sue individually but forfeiting the settlement.

Base tier

The flat payment class members can claim without submitting documentation of losses.

Documented-loss tier

A higher payout available to class members who can prove out-of-pocket losses tied to the incident.

Pro-rata adjustment

Automatic scaling of payouts up or down based on how much of the fund is claimed.

FAQ