The Weekly Breach Breakdown Podcast by ITRC: A Tale of Two Breaches - S6E20

Show Transcript

Welcome to the Identity Theft Resource Center’s (ITRC) Weekly Breach Breakdown for July 3, 2025. I’m Timothy Walden. Thanks to SentiLink for their support of the ITRC and this podcast. Each week, we break down the latest data security incidents making headlines. Today, we’re focusing on a significant lawsuit settlement— the AT&T data privacy settlement. This settlement affected millions of AT&T customers and underscores the increasing complexities of data breach litigation.  

Last month, a federal judge granted preliminary approval for a $177 million settlement between AT&T and the plaintiffs in a massive data breach case. The agreement resolves a long-running legal battle over the telecommunications giant’s alleged failure to properly secure sensitive customer information in two major incidents.  

Here’s the breakdown:  

The first data breach can be traced to 2019, when a dataset containing information about roughly 70 million AT&T customers was first made public online. After denying the company was the source of the compromised information for nearly five years, AT&T confirmed it was the data source in March 2024 after it was offered – again – for free on a hacking forum.  

The second incident occurred in April 2024, when a breach at an AT&T vendor exposed records of approximately 110 million customers, spanning from May 2022 to October 2022. The information included phone numbers, some Social Security numbers and email addresses, making it an ideal target for identity theft and fraud.  

Three people, including a U.S. Army soldier, have been connected to the 2024 data breach, indicating how sophisticated and organized data theft has become.  

What does the AT&T data privacy settlement agreement mean for AT&T customers? Under the proposed agreement, the company will create an all-cash fund totaling $177 million — $149 million for victims of the first data breach and $28 million for the second. Depending on their losses and ability to document them, eligible victims can claim up to $5,000 for the first incident and up to $2,500 for the second.  

The court has also required AT&T to provide a “confidential written attestation” detailing the steps it has taken, or will take, to further secure customer data. This must be delivered within 30 days. Meanwhile, the process for notifying affected customers and accepting claim forms is set to begin on August 4, 2025, with a claim deadline of November 18, 2025.  

This agreement is still preliminary. Final approval of the AT&T data privacy settlement won’t be granted until December 2025. It’s worth noting this comes just months after AT&T reached a $13 million agreement with the FCC to resolve an investigation into its data storage and handling practices.  

If you have questions about the AT&T data privacy settlement, want more information on how to protect your information or suspect a data breach or identity-related crime has impacted you, the ITRC is here to help. You can speak with an expert advisor by phone or text (888.400.5530) or chat live on our website. Just visit www.idtheftcenter.org to get started.  

Thanks again to SentiLink for their support of the ITRC and this podcast. Please hit the like button for this episode and subscribe wherever you listen to your podcasts. We’ll be back next week with another episode of the Weekly Breach Breakdown. I’m Tim Walden. Until then, thanks for listening.