AT&T
AT&T's $177 million data breach settlement received court approval on 2 October 2026, but no payment date has been confirmed Tdorante10, Creative Commons Attribution-Share Alike 4.0/Wikimedia Commons

AT&T's $177 million data breach settlement has won final approval in Dallas, but more than one million claims were rejected during processing.

Senior US District Judge Sidney A. Fitzwater approved the agreement on 2 October 2026. Court records show 4,918,073 claims received by 24 August and 1,099,732 rejected. No date has been announced for the first payments.

The ruling covers lawsuits over two data incidents announced in March and July 2024. The settlement allocates $149 million to the first case and $28 million to the second. AT&T agreed to resolve the litigation without admitting liability or wrongdoing.

According to the court's approval order, 804,381 claims were rejected following fraud screening. That classification is not a criminal finding against individual applicants, and safeguards exist to challenge incorrect decisions. Other rejections included duplicate, late, withdrawn and ineligible claims.

When Will AT&T Settlement Payments Arrive?

The agreement requires electronic payments or paper cheques within 60 days after the settlement becomes effective. Final court approval does not immediately start that clock. The effective date depends on the appeal period and any further proceedings.

Under the ordinary timetable, the deadline for appealing the 2 October ruling would fall on 2 November. Without an appeal or qualifying post-judgment motion, the agreement could become effective around 12 November. The distribution period would then run until approximately 11 January 2027.

Payments could start in December, although the settlement administrator has announced no December timetable. An appeal could delay the effective date, while unresolved claims may require additional review. The official settlement website is the appropriate place to check for updates.

How Much Could AT&T Customers Actually Receive?

AT&T disclosed the first incident on 30 March 2024 after customer information appeared on the dark web. It said approximately 7.6 million current customers and 65.4 million former customers were involved. The exposed information may have included Social Security numbers, dates of birth, and account details.

The second incident, announced on 12 July, involved the download of records from a third-party cloud workspace. According to AT&T's regulatory filing, the records covered customer call and text interactions, not their contents. The company said the files contained no Social Security numbers or birth dates.

Eligible claimants from the first incident can receive up to $5,000 for documented losses fairly traceable to it. The second class permits up to $2,500 for qualifying documented losses from 14 April 2024 onwards. These are maximum reimbursements that require evidence, not standard payments for everyone affected.

Other approved claimants may receive much smaller tiered amounts instead. The court cited estimates of $39 to $40 for Tier 1 and $7.50 to $8.10 for Tier 2. Tier 3 was estimated at $6.50 to $7.10, with eligibility limited to second-class account owners. All estimates depend on final claims and expenses.

AT&T
AT&T claimants can check their payment status and update their details through the official settlement website Rubaitul Azad/Unsplash

There are other limits behind the advertised figures. Line or end users in the second class may claim documented losses but cannot choose tiered payments. Customers eligible under both incidents cannot claim reimbursement twice for the same loss.

Costs also reduce the money available to claimants. The judge approved $59 million in lawyers' fees and approximately $18.86 million in administration costs already incurred. He withheld approval of additional projected administration charges pending further review. Some claimants objected to the compensation, but the judge found the overall settlement fair.

The court also considered complaints that certain payments were inadequate and credit monitoring was absent. Fitzwater rejected those objections, while requiring changes to how any leftover funds might eventually be distributed. The decision does not establish that AT&T caused individual identity theft losses alleged by plaintiffs.

The deadline for filing new claims expired on 18 December 2025. Kroll Settlement Administration required responses to deficient-claim notices by 8 September 2026. Some rejected claimants have a separate opportunity to challenge the denial within 22 days of their notice date.