AT&T's $177 Million Data Breach Settlement Wins Final Approval

AT&T Data Breach Settlement Granted Final Approval: $177 Million Approved, Cy Pres Process Modified

A federal judge in Dallas granted final approval to AT&T's $177 million data breach class settlement on October 2, 2026, approving $59 million in attorney's fees and sustaining one objection, which modified how any leftover money may be spent. The claim window closed December 18, 2025.

Information last verified on October 5, 2026. This is a developing story; we update it as the record changes.

Status: Final approval granted October 2, 2026 by Senior Judge Sidney A. Fitzwater, Northern District of Texas, Dallas Division, in a 73-page memorandum opinion and order docketed as ECF No. 85. The judgment is subject to any appeal. The record reviewed here does not establish an appeal deadline or a payment date.

Jurisdiction scope: This article addresses one federal court order in the Northern District of Texas and the two nationwide AT&T settlement classes it binds. It does not address the individual arbitrations AT&T settled outside this class action, the separate Snowflake multidistrict litigation in Montana, or any state or federal regulatory action against AT&T. For the record we maintain on this matter, see our AT&T settlement tracker entry.

What Happened

On October 2, 2026, Senior Judge Sidney A. Fitzwater of the United States District Court for the Northern District of Texas, Dallas Division, signed a 73-page memorandum opinion and order granting the plaintiffs' November 3, 2025 unopposed motion for final approval of class action settlement, together with the applications for attorney's fees, costs and service awards. The court granted that relief, in its own words, "with a slight modification regarding the cy pres process." The opinion sets out the court's findings of fact and conclusions of law under Federal Rule of Civil Procedure 52(a)(1).

The case numbers do not agree inside the document itself, and we report them as they appear. The opinion's caption reads "Civil Action No. 3:24-CV-00757-E" and "MDL DOCKET No. 3:24-md-03114-E," while the electronic filing stamp at the top of all 73 pages reads "Case 3:24-md-03114-D." In the Northern District of Texas the letter after the case number designates the assigned judge: the court's own designation list assigns E to Judge Ada Brown and D to Senior Judge Sidney A. Fitzwater, and this proceeding changed judges six weeks before the order issued.

The word "unopposed" in the motion's title is doing narrow work, and the court flagged that in its first footnote.

The motion is "unopposed" insofar as plaintiffs and defendants do not oppose it. There are objectors who oppose the motion.

Memorandum Opinion and Order at 1 n.1 (N.D. Tex. Oct. 2, 2026).

Roughly 45 objectors filed objections, according to the opinion, which the court described as "certainly not an overwhelming rejection of the Settlement." All but one of the objections the court reached were overruled.

How the case reached this point

Judge Ada Brown entered the preliminary approval order on June 20, 2025 and held the fairness hearing on January 15, 2026. While the motion was under advisement, she recused herself on August 14, 2026, and the Judicial Panel on Multidistrict Litigation reassigned the MDL proceeding to Judge Fitzwater on August 17, 2026. The opinion states that the undersigned judge read the hearing transcript and reviewed the briefing, the objections and the case docket before ruling, which is how a judge who did not preside over the fairness hearing can decide the motion on the existing record.

The litigation consolidates two separate incidents. The first, which the opinion calls the AT&T 1 Data Incident, was announced on March 30, 2024. According to the master complaint, AT&T 1's systems were compromised by a third-party threat actor sometime in 2019, and the exposed data set is alleged to have included Social Security numbers, dates of birth, AT&T account numbers and account passcodes. That data appeared on the dark web on or before August 20, 2021, and AT&T announced the breach almost three years later.

The second, announced on July 12, 2024, is the AT&T 2 or Snowflake incident. Limited call log data was illegally downloaded from AT&T's workspace on a third-party cloud platform provided by Snowflake, Inc. The opinion is specific about the scope: telephone numbers of current and former customers, the telephone numbers those customers interacted with, counts of those interactions, aggregate call durations for a day or month, and, for a small subset of individuals, one or more cell site identification numbers. The opinion states that the data did not include text content, customer names, Social Security numbers, dates of birth, or other personally identifiable or financial information.

The Panel centralized the AT&T 1 actions in the Northern District of Texas as MDL No. 3114 on June 5, 2024. The AT&T 2 actions were initially part of a separate Snowflake MDL before Judge Brian M. Morris of the District of Montana, and that court authorized their transfer to Texas at a June 23, 2025 status conference. The parties mediated separately from March 17 to 19, 2025 with mediator Robert A. Meyer, negotiated for roughly ten more weeks, and signed a single settlement agreement on May 30, 2025.

The money, and what class members were told to expect

The settlement creates two non-reversionary, all-cash funds totaling $177 million: $149 million for the AT&T 1 settlement class and $28 million for the AT&T 2 settlement class. Non-reversionary means nothing goes back to AT&T. The opinion states that any unclaimed funds will be distributed to class members through redistribution, or distributed via cy pres, but that no settlement funds will revert to the company.

The classes are very large. For notice purposes, the administrator counted 99,763,302 settlement class member records: 57,002,042 for AT&T 1 only, 36,478,626 for AT&T 2 only, and 6,282,634 overlap members who belong to both classes. Overlap members may submit claims to both settlement funds, subject to what the opinion calls reasonable limitations on documented loss claims to prevent duplicative recovery. All objections to the treatment of overlap members were overruled.

Two kinds of payment were available. A class member with proper proof could claim a documented loss payment of up to $5,000 under AT&T 1 or up to $2,500 under AT&T 2. Alternatively, a class member could elect a tiered cash payment calculated pro rata from the applicable net settlement fund. Those ceilings are not what most claimants are in line to receive. The opinion reproduces the administrator's estimates, "contingent on certain variables," as follows: AT&T 1 Tier 1 at $39 to $40, AT&T 2 Tier 2 at $7.50 to $8.10, and AT&T 2 Tier 3 at $6.50 to $7.10.

The filing window is closed. An October 3, 2025 order amending the preliminary approval order extended the opt-out and objection deadlines to November 17, 2025 and the deadline to submit claim forms to December 18, 2025. Nothing in the October 2, 2026 opinion reopens the claims process for new claimants, and no page on this site can accept or forward a claim.

Participation was large in absolute terms and small as a share of the class. The opinion records Kroll's statement that the 4.8 percent claims rate is higher than the majority of settlements it has administered, and the court relied on that in overruling the objections to the claims procedures. Kroll Settlement Administration, LLC reported 754,263 claim forms received by mail and 4,163,810 filed electronically, for a total of 4,918,073 claims, which the record describes as a 4.8 percent claims rate. Of those, 1,099,732 were rejected as late, duplicative, fraudulent, released, withdrawn or from an ineligible business. The allowed claims break down as 1,654,046 at Tier 1, 687,859 at Tier 2 and 1,582,248 at Tier 3.

What the Law Actually Says

A class action settlement is not a private contract that a judge rubber-stamps. Under Federal Rule of Civil Procedure 23(e)(2), a court may approve a settlement that would bind class members "only after a hearing and only on finding that it is fair, reasonable, and adequate." The rule directs the court to consider whether the class representatives and class counsel adequately represented the class, whether the proposal was negotiated at arm's length, whether the relief is adequate in light of the costs, risks and delay of trial and appeal, the effectiveness of the distribution method, the terms of any fee award and any side agreements, and whether the proposal treats class members equitably relative to each other.

Courts in the Fifth Circuit layer a second checklist on top. Under Reed v. General Motors Corp., 703 F.2d 170, 172 (5th Cir. 1983), the district court must also weigh the existence of fraud or collusion, the complexity and expense of the litigation, the stage of proceedings and amount of discovery completed, the probability of success on the merits, the range of possible recovery, and the opinions of class counsel, class representatives and absent class members. The October 2 opinion works through all six, and through each Rule 23(e)(2) factor, before concluding that the settlement is fair, reasonable and adequate.

Two features of the opinion explain why a reader who was never contacted can still be bound. First, due process in a class action for money damages requires adequate notice, an opportunity to be heard, an opportunity to opt out, and adequate representation, under Phillips Petroleum Co. v. Shutts, 472 U.S. 797 (1985). The court found the notice program satisfied Rule 23(c)(2)(B), Rule 23(e)(1) and due process: direct notice likely reached 86,912,467 records, about 87.1 percent of the class, and the direct and supplemental media campaigns together were estimated to have reached 90 percent. Second, the court held that being bound does not depend on being paid. It rejected the argument that the release should apply only to class members who actually receive money, reasoning that nothing in Phillips conditions the binding effect of a judgment on collecting it.

The Class Action Fairness Act piece is procedural but not optional. Under 28 U.S.C. section 1715(b), a defendant must notify the appropriate state and federal officials of a proposed class settlement, and section 1715(d) imposes a waiting period before final approval. The opinion records that notice went to the Attorney General of the United States and the attorneys general of all 50 states, the District of Columbia and the territories on June 9, 2025, that the 90-day period expired, and that no government official objected or commented.

The cy pres question turns on Fifth Circuit law that treats charitable distribution as a last resort. Under Klier v. Elf Atochem North America, Inc., 658 F.3d 468, 475 (5th Cir. 2011), a cy pres distribution is appropriate where direct distribution to class members is not feasible, and the recipient should have a sufficient nexus to the interests of the class. That doctrine is what the October 2 order applies when it reorders the sequence for leftover money, and it is the reason the single sustained objection changed the settlement's mechanics rather than its dollar figures.

For context on how these standards played out in the comparable matter the objectors leaned on, see our page on the T-Mobile data breach settlement. For the earlier stage of this story, our August coverage explains what happened when the MDL changed judges with final approval still pending. And for the general sequence that follows any breach notice, independent of this settlement, see our guide on what to do after a data breach.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The gap between $5,000 and $39 is the most useful thing in this opinion, and it is not a scandal. It is how a common fund works. A documented loss cap is a ceiling for claimants who could document out-of-pocket losses fairly traceable to the breach, a group whose size the opinion does not report; the tiered cash payment is a pro rata slice of what is left of the fund after documented loss payments, fees, costs, service awards and administration, divided among millions of allowed claims. The opinion is explicit that tiered payments come only after those with documented out-of-pocket losses are compensated. Coverage that leads with the ceiling describes a payment almost nobody receives. The court itself leaned on the estimates rather than the caps when it answered the objection that AT&T 2 Tier 3 claimants would get nothing, writing that "Tier 3 claimants with valid claims will in fact recover more than nothing" on Kroll's advice that each Tier 3 class member will receive approximately $6.50 to $7.10.

What the deductions add up to is worth stating plainly, because the opinion never totals them. By our arithmetic on the amounts the court approved, $59,000,000 in fees, $1,060,051 in litigation costs, $54,000 in service awards and $18,856,175.48 in administration charges come to $78,970,226.48, or about 45 percent of the $177 million, with roughly $4 million in further administration estimates still unresolved. The court did not state a combined percentage and these components are approved against their own funds and standards, so the figure is an aggregate rather than a finding. It is still the number a class member is effectively asking about when they ask why the payment is $39.

The administration line is where this judge departed from routine. Kroll's original estimate in the preliminary approval order was $5,453,185.00. The opinion states that the total estimate is now $22,161,587.09, which it breaks out as $18,856,175.48 billed to date and $4,008,426.50 estimated to be billed. The court approved the billed amount, reserved judgment on the rest, and explained why it was not simply confirming the request.

Additionally, in this case, claims administration costs are paid out of the common settlement fund rather than by AT&T. Every dollar that is paid for administration represents one dollar less that is available for Settlement Class Members.

Memorandum Opinion and Order at 63 (N.D. Tex. Oct. 2, 2026).

The cy pres ruling is modest in dollars and meaningful in principle. The court sustained the objection to designating the Texas Bar Foundation as the recipient of residual funds, called the foundation a worthy organization while finding that "the nexus to data breach victims specifically is indirect," and disclosed in a footnote that the undersigned judge is a Life Fellow of that foundation. It then inverted the default: residual money must first be considered for redistribution to claiming class members where that is economically feasible and administratively practical, cy pres is available only if further redistribution is not feasible, and any eventual recipient must bear a substantial nexus to data privacy, cybersecurity, consumer protection or access to justice interests implicated by the claims. It directed the parties to recommend other cy pres recipients for consideration in addition to the Texas Bar Foundation, rather than striking the Foundation. The parties and Kroll are directed to report the residual and recommend whether redistribution should occur.

The fraud numbers deserve more attention than they usually get. Approximately 804,381 claims, about 16 percent of everything filed, were declined for fraud, and the screening was not done by the administrator. It was performed by ClaimScore, LLC, doing business as Covalynt, using a proprietary scoring model whose details the opinion says could not be filed publicly without compromising the system and revealing commercially sensitive information. The court did not take that on faith: it recorded that counsel spent two months questioning the vendor in multiple conferences, as reported in the declaration of AT&T's counsel, compared its methods to financial services fraud detection, reviewed how other federal courts had handled the same vendor, and approved a notice and cure process built with the court-appointed special master, retired United States District Judge Royal Furgeson. Still, the structural tension is now a permanent feature of mass claims practice. Machine scoring at that scale protects the fund from being drained by fraudulent filings, and it also means a legitimate claimant can be rejected by a model nobody outside the room can audit.

Finally, the arbitration holding is the part the court itself wrote up for a reviewing court. AT&T's customer agreement contains a class waiver and a mandatory arbitration clause, and the company has enforced it successfully, including in AT&T Mobility LLC v. Concepcion, 563 U.S. 333 (2011). Objectors argued that using Rule 23 to bind customers who agreed to individual arbitration would abridge a substantive right in violation of the Rules Enabling Act, 28 U.S.C. section 2072(b). The court held that the opt-out mechanism preserves the right, made four express findings because, as it wrote, "this objection may be raised on appeal," and separately rejected the argument that AT&T is judicially estopped from settling claims it once argued could not proceed as a class. A court that writes findings specifically for a reviewing court is telling you where it expects the pressure to land.

How This Affects You

If you were in either class, the filing stage is over. The deadline to submit a claim form was December 18, 2025, and the October 2, 2026 order does not reopen it. Anyone who did not file by that date is still bound by the releases unless they were among the opt-outs the court approved.

If you did file, the opinion directs Kroll to continue processing claims, including verifying eligibility, reviewing documentation for documented loss claims, curing deficient claims and disbursing payment. Kroll is the only administrator the court confirmed. Communications about this settlement that do not come from the court-appointed administrator are not part of the process the court approved, and no site, including this one, can look up, expedite or release an individual payment.

Claimants whose filings were flagged as fraudulent are the group with something still to do, and the order describes the mechanism in general terms. The order describes a proposed notice-and-cure process the court found to be an appropriate safeguard. Under it, Kroll will notify affected claimants by email that the claim was flagged, with instructions and a link to a downloadable validation form; curing will require printing and completing that form, signing it with an original wet signature, and mailing a hard copy postmarked within 21 days of the notification email, one form per envelope, with no bulk submissions accepted. Kroll will also design and maintain a dedicated frequently asked questions page on the settlement website about the cure process. The opinion states that the review process for cure submissions will be established once the volume is known.

On timing, the honest answer is that this record does not supply one. A final approval judgment is subject to appeal, and the opinion states that the Settlement Agreement provides for payments to be distributed electronically or by paper check within 60 days after the Effective Date. The opinion reproduces the Settlement Agreement's provision for payment within 60 days after the Effective Date but does not define the Effective Date or set one, and as of October 5, 2026 the record reviewed here establishes neither an appeal deadline nor a distribution date. Dates circulating in secondary coverage are not in this order.

On credit protection, note what this settlement does not include. It provides no credit monitoring, and the court overruled the objections about its absence, reasoning that monitoring periods vary, all eventually expire, and the benefit is uncertain, so it is not a required element of every settlement. That leaves a credit freeze as the main protective step a class member can take without the settlement's help, and our guide to placing a free credit freeze after a breach covers the step that comes first.

Finally, people who were sorted into the opt-out categories are in a different posture. The court approved 494 compliant opt-outs and a further 2,332 submitted through two firms, and those individuals are excluded from the classes, are not bound by the releases, and retain the right to pursue individual claims. The court also noted that after the opt-outs take effect the parties must resolve those individual claims in arbitration, which is where AT&T may press its argument that some opt-outs were procured by misleading solicitations.

What the Court Did With the Objections

The adequacy objections were the core of the opposition, and the comparator was T-Mobile. Objectors pointed to a reported $350 million fund, a $25,000 documented loss cap, compensation for lost time, two years of credit monitoring and a $150 million security spending commitment, against AT&T's $177 million, its $2,500 and $5,000 caps, and no monitoring or committed security spend. The court declined to treat headline comparisons to other settlements as a substitute for the analysis Rule 23(e) and Reed require, pointed to a range of other approved data breach settlements, and overruled the objection.

Several other objections were overruled on reasoning worth knowing. The claim that class counsel failed to supply a classwide damages model under Comcast Corp. v. Behrend, 569 U.S. 27 (2013), failed because Comcast addressed a litigation class and this case will not be tried. The argument that variations among the 50 states' breach notification and consumer protection laws defeat predominance failed because the settlement provides uniform relief regardless of residence. The reverse auction allegation failed because, in the court's view, class counsel cannot be characterized as the least effective attorneys, and because the option to opt out was always available whether AT&T's individual arbitration settlements came before or after the class deal.

The objection that the releases are too broad was overruled with an express limiting finding: the release reaches claims arising from the same nucleus of operative facts, and opt-outs, in the court's words, "release nothing." Snowflake is a released party that did not contribute to the fund, which the court found supported by consideration because AT&T's payment reflects the total value of settling all claims arising from the incidents. Objections to the lack of mandated security upgrades were overruled on the view that mandating specific technical measures raises issues that may not be appropriate for judicial resolution.

The opt-out procedure drew its own fight. Objectors argued that requiring a handwritten wet ink signature was designed to suppress opt-outs and ignored the federal ESIGN Act and the Uniform Electronic Transactions Act. The court found both statutes preserve a court's discretion to require a wet signature, and upheld the requirement in light of the level of fraud reported in claim filings. That ruling had direct consequences: of 6,802 opt-outs rejected as late or non-compliant, 5,999 had been submitted by one firm with electronic signatures contrary to the preliminary approval order, and those individuals remain class members bound by the releases. The court also noted an arithmetic discrepancy in the administrator's own opt-out tally, observing that the categories add to 9,628 rather than the 9,627 reported, and proceeded despite it.

The Fee Award and the Lodestar Cross-Check

Class counsel asked for one third of each fund and received it. The court approved $49,666,666.66 for AT&T 1 class counsel and $9,333,333.33 for AT&T 2 class counsel, a total of $59 million, or 33.33 percent of the combined $177 million, and overruled the objection that a one-third contingency is unreasonable in a case that settled before any answer or formal discovery.

The Fifth Circuit requires a percentage award to be cross-checked against the lodestar. The opinion reports $12,841,203.00 of billable time for AT&T 1 counsel and $2,505,245.00 for AT&T 2 counsel, producing multipliers of 3.86 and 3.73, which the court found within the general range of multipliers in comparable cases. It weighed the Johnson factors, noted a declaration from Vanderbilt law professor Brian T. Fitzpatrick reporting average and median Fifth Circuit fee percentages of 26.4 percent and 29 percent, and acknowledged in a footnote that Fitzpatrick's own study of megafund settlements between $100 million and $250 million found average and median percentages of 17.9 percent and 16.9 percent. The court concluded that Fifth Circuit precedent does not require a district court to follow that megafund trend.

Litigation costs of $828,612.64 for AT&T 1 counsel and $231,438.36 for AT&T 2 counsel were approved, each payable from its own fund. Service awards of $1,500 for each class representative, totaling $54,000 across the 36 representatives, were approved and all objections to them were overruled.

What Happens Next

The opinion identifies three threads that remain open, and they are the only forward-looking items this record supports. The parties and Kroll are to report the residual funds remaining after distribution along with recommendations on whether redistribution should be considered, and if the court orders redistribution, Kroll may apply for further compensation to carry it out. Any administration costs beyond the amount approved must be presented to the court. And the court wrote that settlement administration costs will continue to command its attention, stating that it has placed the status of claims administration on the agenda of a status conference being set by Case Management Order #18.

Beyond that, the general mechanism applies. A final approval judgment in a class action is subject to appeal, and the settlement's effective date, which starts the 60-day payment clock in the agreement, depends on how any appeal is resolved. As of October 5, 2026 we have seen no order in this record setting an appeal deadline, and we are not reporting one.

This is general legal information, not legal advice. It covers one federal court order in the Northern District of Texas and the two nationwide AT&T settlement classes it binds, and reflects sources verified on October 5, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

Related articles

• Our AT&T data breach settlement tracker entry
• When the AT&T MDL was reassigned with final approval still pending
• What to do after a data breach
• How to freeze your credit after a data breach
• The T-Mobile data breach settlement

---

Last updated: 2026-10-05. This is a developing story; details verified as of 2026-10-05.

Frequently Asked Questions

Can I still file a claim in the AT&T data breach settlement?

No. The deadline to submit claim forms was December 18, 2025, set by an October 3, 2025 order amending the preliminary approval order, and it has passed. The October 2, 2026 final approval order does not reopen it. Recording Law is not the settlement administrator, the court, or a filing venue.

How much are class members actually expected to receive?

The administrator's estimates in the record are roughly $39 to $40 for an AT&T 1 Tier 1 payment, $7.50 to $8.10 for AT&T 2 Tier 2, and $6.50 to $7.10 for AT&T 2 Tier 3, which the opinion describes as contingent on certain variables. Documented loss claims were capped at $5,000 for AT&T 1 and $2,500 for AT&T 2 with proper proof, but a cap is a ceiling for claimants who could document losses, not a typical payment.

When will payments be distributed?

The order does not set a payment date. It states that the Settlement Agreement provides for payments to be distributed electronically or by paper check within 60 days after the Effective Date, and the Effective Date depends on the resolution of any appeal. As of October 5, 2026, the record reviewed here establishes neither an appeal deadline nor a distribution date.

What did the judge actually change about the settlement?

One thing. The court sustained the objection to naming the Texas Bar Foundation as the cy pres recipient of residual funds and modified the cy pres process, directing that residual money first be considered for redistribution to claiming class members where feasible and that any eventual cy pres recipient bear a substantial nexus to data privacy, cybersecurity, consumer protection or access to justice interests. The rest of the settlement was approved as presented.

Does the AT&T settlement include free credit monitoring?

No. Objectors raised the absence of credit monitoring and the court overruled those objections, reasoning that monitoring periods vary, all eventually expire, and the benefit is uncertain, so it is not a required element of every settlement. Freezing your credit at each nationwide credit bureau is the no-cost step our breach guides cover first.

Why were more than 800,000 claims rejected for fraud?

Fraud screening was performed by ClaimScore, LLC, doing business as Covalynt, rather than by the administrator. Covalynt identified approximately 804,000 electronic claims as fraudulent and recommended rejection, and roughly 804,381 claims, about 16 percent of all claims received, were declined on that basis. The court reviewed counsel's two-month diligence into the methodology and approved a notice and cure process built with the court-appointed special master, retired United States District Judge Royal Furgeson.

What happens to a claim that was flagged as fraudulent?

The order describes a notice and cure process. The administrator emails the affected claimant that the claim was flagged, with instructions and a link to a downloadable validation form. Curing requires printing and completing the form, signing it with an original wet signature, and mailing a hard copy postmarked within 21 days of the notification email, one form per envelope, with no bulk submissions accepted.

What happened to people who tried to opt out of the settlement?

The administrator received 10,741 opt-out requests. The court approved 494 that were timely and compliant, plus 2,332 submitted through Harrer Law, P.C. and Potter Handy, LLP, and rejected 6,802 as late or non-compliant, including 5,999 filed by one firm with electronic rather than wet ink signatures. Approved opt-outs are excluded from the classes and keep their individual claims; rejected opt-outs remain class members bound by the releases.

Did Snowflake pay anything into the settlement?

No. The opinion states that Snowflake is a released party that did not contribute directly to the settlement fund, and the court found the release supported by consideration because AT&T's contribution reflects the total value of settling all claims against all parties arising from the data incidents.

Is this settlement smaller than the T-Mobile data breach settlement?

Objectors argued it is worse on several metrics, citing a reported $350 million T-Mobile fund, a $25,000 documented loss cap, compensation for lost time, two years of credit monitoring and a $150 million security spending commitment. The court declined to treat headline comparisons to other settlements as a substitute for the analysis Rule 23(e) and the Fifth Circuit Reed factors require, and overruled the objection.