AT&T's $177 Million Data Breach Settlement Sounds Huge, but Some Customers May Get as Little as $6.50

AT&T's $177 million data breach settlement may sound like a major payday for millions of affected customers, but the reality is far less generous. Depending on which breach they were affected by and the payment tier they qualify for, some eligible claimants could receive as little as $6.50, which is way below the thousands of dollars some may have expected.

US District Judge Sidney Fitzwater approved the settlement on 2nd October 2026, resolving litigation stemming from two separate AT&T data incidents in 2024.

The settlement consists of $149 million for the first data incident and $28 million for the second, for a combined $177 million. AT&T has denied wrongdoing and agreed to settle the litigation rather than continue fighting the claims in court.

The first incident, announced in March 2024, involved a dataset containing information about 73 million current and former AT&T account holders, including Social Security numbers, which appeared on the dark web. Specifically, the data also included personal information such as addresses and passcodes, and appeared to date to 2019 or earlier.

The second incident involved data that was illegally downloaded from a third-party cloud platform and was announced by AT&T in July 2024. The exposed data included call and text message records from a roughly six-month period in 2022 involving nearly all of AT&T's cellular customers.

Millions of Customers Could Receive $6.50 to $40 Settlement Payouts

The biggest catch for claimants is the stark gap between AT&T's $177 million settlement and the amount individual customers may actually receive.

Court documents outline three estimated payment tiers for customers who opted for tiered cash payments. Eligible customers whose Social Security numbers were exposed in the first data incident fall under Tier 1, and are estimated to receive between $39 and $40.

Customers affected by the March 2024 incident whose Social Security numbers were not exposed were eligible for the Tier 2 payments of $7.50 to $8.10, while customers covered by the July 2024 incident were eligible for Tier 3 payments of $6.50 to $7.10.

Close to five million claim forms had been submitted as of 24th August, according to the court's final approval order. The settlement administrator had received 754,263 paper claims and 4,163,810 electronic claims, for a total of 4,918,073 claims.

The final settlement approval also includes $59 million in attorneys' fees, according to Reuters, after lawyers negotiated the settlements over the data breaches.

Why the Payouts Are So Much Lower Than the Maximum Limit of $5,000

The settlement originally allowed certain customers to seek up to $5,000 for documented losses connected to the first data incident, while eligible customers affected by the second incident could seek up to $2,500.

Note that the $5,000 and $2,500 figures were maximum amounts available for qualifying documented losses, and not standard payouts for every claimant. Customers seeking documented-loss payments had to provide evidence of qualifying losses that could be traced to the relevant data incident.

Customers could instead choose the applicable tiered cash payment, which did not require them to prove the same level of documented financial loss.

Those who chose tiered cash payments will receive a share calculated on a pro rata basis from the applicable net settlement fund, meaning the estimated amounts can change depending on the number and value of valid claims and other deductions. Payments are expected to be distributed after the appeal period has expired.