Frontier to Pay Connecticut $625,000 Over 2024 Data Breach

Frontier to Pay Connecticut $625,000 Over 2024 Data Breach

Connecticut Attorney General William Tong announced a $625,000 settlement with Frontier Communications Parent Inc. on October 16, 2026, closing a state investigation into an April 2024 breach that exposed the Social Security numbers of 58,841 Connecticut residents.

Information last verified on October 19, 2026. This is a developing story; we update it as the record changes.

Jurisdiction scope: This article addresses the Connecticut Attorney General's October 16, 2026 settlement with Frontier Communications Parent Inc., the Connecticut statutes it names, and the separate class settlement in the Northern District of Texas. It does not address other states' investigations of the same breach, federal regulatory action, or what any individual should do about a claim.

What Happened

Attorney General William Tong announced the settlement on October 16, 2026. According to his office's press release, a threat actor used compromised credentials belonging to Frontier employees and vendors to reach Frontier's internal IT systems in April 2024 and exfiltrate unencrypted personal information. The stolen data included the Social Security numbers of 58,841 Connecticut residents. The release states that the threat actor "later offered the stolen data for sale on the dark web."

The $625,000 goes to the state. On top of that payment, the release lists injunctive terms that bind Frontier going forward: compliance with Connecticut's consumer protection and data privacy laws, a comprehensive information security program with reporting requirements to the CEO, employee training, an incident response plan, and a long list of named safeguards covering document retention and deletion, logging and monitoring, segmentation, access controls, password management, multifactor authentication, encryption, risk assessments, penetration testing, antivirus maintenance, data loss prevention, component hardening, and intrusion and endpoint detection. Frontier must also obtain a third-party assessment within one year of the agreement's effective date and send a copy of that report to the Attorney General.

Tong's statement framed the duty in plain terms:

"Frontier collected and maintained sensitive records for tens of thousands of Connecticut customers, and they had an obligation to secure that data." Attorney General William Tong, Office of the Attorney General press release, October 16, 2026

Two things are worth stating precisely. First, every figure and term above comes from the Attorney General's own announcement. The settlement document is not linked from that release, and we found no copy of it posted on portal.ct.gov as of October 19, 2026. We have not read the agreement, so we do not describe its recitals, its release language, or even its formal title. Second, the release does not report an admission by Frontier or a finding by any court or agency that Frontier broke a Connecticut statute. It reports the Attorney General's own investigative conclusion that the office "identified multiple security failings," and it notes that "Frontier and Verizon cooperated with the state's investigation." Verizon completed its acquisition of Frontier in January 2026; Frontier's filing with the Securities and Exchange Commission reports a completion of acquisition and a change in control of the registrant with an earliest event date of January 16, 2026.

What Connecticut Law Requires

The release's first injunctive term names three Connecticut laws: the Connecticut Unfair Trade Practices Act, the Connecticut Data Privacy Act and the Safeguards Law. A fourth statute, the breach notification law, is not named in the release but governs the notice duties that this incident triggered. Each does different work.

Breach notification: Conn. Gen. Stat. § 36a-701b. Anyone who owns, licenses or maintains computerized data containing personal information must notify affected Connecticut residents "without unreasonable delay but not later than sixty days after the discovery of such breach," under subsection (b)(1). Subsection (b)(2)(A) requires notice to the Attorney General "not later than the time when notice is provided to the resident." Where the exposed data includes a Social Security number or a taxpayer identification number, subsection (b)(2)(B) requires the company to offer identity theft prevention services at no cost "for a period of not less than two years," and to tell the resident how to place a credit freeze. Subsection (j) supplies the teeth: failure to comply "shall constitute an unfair trade practice for purposes of section 42-110b and shall be enforced by the Attorney General." The definition in subsection (a)(1) matters here too, because a "breach of security" under the statute is unauthorized access to data "when access to the personal information has not been secured by encryption or by any other method or technology that renders the personal information unreadable or unusable." Encryption, or another method that renders the data unreadable or unusable, is what keeps an incident outside the statute. Subsection (b)(1) also excuses notice where the person reasonably determines, after an appropriate investigation, that the breach will not likely result in harm to the individuals whose personal information was acquired or accessed. Our Connecticut breach notification requirements page walks through the timing and content rules in more detail.

The Safeguards Law: Conn. Gen. Stat. § 42-471. Subsection (a) is one sentence and it is broad: "Any person in possession of personal information of another person shall safeguard the data, computer files and documents containing the information from misuse by third parties, and shall destroy, erase or make unreadable such data, computer files and documents prior to disposal." Subsection (b) adds that anyone who collects Social Security numbers in the course of business must create and publish a privacy protection policy that protects their confidentiality, prohibits unlawful disclosure, and limits access. A violation is an unfair trade practice under § 42-110b(a), and subsection (e)(1) says flatly that "Nothing in this section shall be construed to create a private right of action."

The Connecticut Data Privacy Act: Conn. Gen. Stat. § 42-515 et seq. The CTDPA's data security duty sits at § 42-520(a)(3): a controller must "establish, implement and maintain reasonable administrative, technical and physical data security practices to protect the confidentiality, integrity and accessibility of personal data appropriate to the volume and nature of the personal data at issue." Enforcement is narrow by design. Section 42-525(a) gives the Attorney General "exclusive authority" to enforce, and § 42-525(d) says nothing in the act provides a basis for a private right of action. The cure period has changed since the act took effect, which readers often get wrong: the mandatory 60-day cure notice ran only from July 1, 2023 through December 31, 2024. Since January 1, 2025, § 42-525(c) makes a cure opportunity discretionary, and the Attorney General may weigh seven factors in deciding whether to grant one, including the number of violations, the substantial likelihood of injury to the public, and the sensitivity of the data. Our guide to what the CTDPA actually covers explains the applicability thresholds, and the broader Connecticut consumer privacy rights overview covers the access, deletion and opt-out rights the act grants.

CUTPA: Conn. Gen. Stat. § 42-110b. This is the hook all three of the above route through. Subsection (a) provides that "No person shall engage in unfair methods of competition and unfair or deceptive acts or practices in the conduct of any trade or commerce," and subsection (b) provides that the commissioner and Connecticut courts shall be guided by Federal Trade Commission and federal court interpretations of Section 5(a)(1) of the FTC Act.

One structural note on the settlement's first injunctive term. Requiring a company to comply with CUTPA, the CTDPA and the Safeguards Law restates obligations that already applied to it. Promising forward compliance with a statute is not the same as conceding a past violation of it, and Connecticut's own consumer protection chapter draws that line explicitly for one settlement form: § 42-110j, which lets the Commissioner of Consumer Protection accept an assurance of voluntary compliance, provides that no such assurance "shall be considered an admission of violation for any purpose." We cannot say whether the Frontier agreement took that form, because the document is not public. What we can say is that the release itself asserts no admission and reports no adjudication.

State Enforcement Versus the Class Settlement

Readers routinely merge these two proceedings into one. They are different cases, with different plaintiffs, different money, and different consequences for an individual.

The Connecticut action is state enforcement. The Attorney General investigated under state law, and the resolution pays the state $625,000 and imposes security obligations on the company. There is no consumer fund, no claim form, no eligibility test and no deadline. A Connecticut resident among the 58,841 affected people cannot file for a share of the $625,000, because it is not a consumer remedy. What a resident gets from this settlement is prospective: a company required to run a security program, train staff, keep an incident response plan, and submit to a third-party assessment it must hand to the Attorney General.

The class settlement is where consumers could get money, and it has its own record. The individual suits filed after the breach were consolidated in the Northern District of Texas before Judge Sam A. Lindsay, whose July 25, 2024 order folded fourteen member cases into Wilson v. Frontier Communications Parent Inc., No. 3:24-cv-01418-L, as the lead case. The parties signed a settlement agreement on April 11, 2025. Judge Lindsay granted preliminary approval on August 20, 2025, certifying for settlement purposes a class of "All living individuals residing in the United States who received notice of the Data Incident indicating their Private Information may have been impacted in the Data Incident," and approving a "non-reversionary $5,640,000 common cash Settlement Fund." The magistrate judge's findings put the class at 751,895 consumers who had applied to Frontier for residential services, a figure the September 2025 final approval motion later states as 739,276, and described the benefits: a documented-loss payment capped at $5,000, or in the alternative a flat cash payment estimated at $100, plus an option to claim two years of credit monitoring, with the cash payments subject to pro rata adjustment depending on how many valid claims came in. The court appointed Epiq as settlement administrator.

The claim window for that fund is shut. Plaintiffs' September 26, 2025 motion for final approval records an opt-out and objection deadline of October 14, 2025 and a claim form deadline of October 27, 2025. The same filing reports that as of September 18, 2025, the administrator had received 5,527 claim forms, no opt-out requests and no objections. Against the 739,276 settlement class members that same filing counts, that is a filing rate under one percent as of that date, with about a month left to claim. A final approval hearing was held on November 18, 2025, and the docket has moved since. Class counsel filed a further declaration in support of final approval on November 23, 2025, and the court entered an order on a pending motion on February 3, 2026 at ECF 75 and a further order on February 10, 2026 at ECF 77, which is the last filing the public record shows. Neither of those two orders is in the free federal court document archive, so we have not read either one, and we therefore do not report a final approval order, a fee award or a judgment as a fact; readers who want the current posture should check the docket in Case No. 3:24-cv-01418-L. We are also not naming a settlement website, because the claim period closed and we will not point readers at a claims page they cannot use.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The most useful part of this announcement is not the dollar figure. It is the list. Connecticut named seven failure categories, and then named the fixes it extracted, and the two lists line up: compromised employee and vendor credentials against required access controls, password management and multifactor authentication; a segmentation failing against required segmentation; exfiltration of unencrypted data against required logging, monitoring, intrusion detection and data loss prevention; unencrypted Social Security numbers against required encryption. Read together, the diagnosis and the remedy function as a statement of what the office treats as the floor for a company holding Social Security numbers in Connecticut, articulated with far more specificity than § 42-520(a)(3)'s "reasonable administrative, technical and physical data security practices" or § 42-471(a)'s duty to "safeguard the data" supply on their own.

The encryption point carries particular weight because of how § 36a-701b is built. Its definition of "breach of security" turns on data not secured by encryption or an equivalent method, so encryption is simultaneously a security control and the line between a reportable incident and a non-event. A company that stores Social Security numbers unencrypted has, by statutory design, left itself without the one condition that would keep a breach of those records outside the notification regime, and so outside the Attorney General's enforcement path under subsection (j).

The two-settlement structure also shows what each mechanism is actually built to do, and the numbers are instructive. The state took $625,000 and company-wide security obligations with an audit requirement and a report delivered to the regulator. The class case produced $5,640,000 for the 739,276 class members the final approval motion counts, from which administration costs, attorney fees and service awards come before anyone's check, and which as of September 18, 2025 had drawn 5,527 claims. The enforcement action reaches every future customer whose data Frontier holds, whether or not that customer ever hears about it. The class action reaches the people who opened the postcard and filed on time. Neither one substitutes for the other, and Connecticut's release calls the class settlement separate and describes the state settlement as following it.

Finally, the enforcement architecture is worth noticing because it is consistent across the Connecticut privacy statutes in play here, both the two the settlement names and the breach statute it does not. Section 36a-701b(j) routes violations to the Attorney General, § 42-471(e)(1) forecloses a private right of action, and § 42-525(a) and (d) give the Attorney General exclusive authority while barring private suits under the CTDPA. Connecticut consumers who want a statutory privacy claim enforced do not file it themselves; the Attorney General's office is the mechanism. That is also why the Attorney General's published CTDPA enforcement report, issued April 17, 2025, describes an office that has "issued dozens of notices of violation ('cure notices')" and that handles both the CTDPA and the breach statute through a standalone Privacy Section.

How This Affects You

If you were notified about the April 2024 Frontier incident, the practical situation as of October 19, 2026 is this. The Connecticut settlement gives you nothing to file, because it pays the state. The class settlement's claim form deadline was October 27, 2025, so if you did not file then, that window is closed; if you did file, the administrator's records and the court docket in Case No. 3:24-cv-01418-L are where the status lives.

Separately, Connecticut law entitles residents whose Social Security number was exposed in a reportable breach to free identity theft prevention services for at least two years, and requires the notifying company to tell them how to place a credit freeze, under § 36a-701b(b)(2)(B). Those are statutory entitlements attached to the breach notice itself, not to either settlement, and they are worth checking in the notice letter you received.

A credit freeze is free, and it blocks the opening of new accounts in your name, which is the exposure a leaked Social Security number creates. Connecticut's breach statute reflects that priority by requiring the notifying company to tell affected residents how to place one. Our walkthrough of how to freeze your credit with each bureau covers the process at all three agencies, and our breach response checklist covers what else to review and in what order. We do not recommend paid monitoring products; where a settlement or a breach notice offers monitoring at no cost, that is the version you have already paid for.

This is general legal information, not legal advice. It covers Connecticut state law and a class settlement in the United States District Court for the Northern District of Texas, and reflects primary sources verified on October 19, 2026. Laws change, dockets move, and this story is developing. For your specific situation, consult a lawyer licensed in your jurisdiction.

Related articles

• Connecticut data privacy laws and consumer rights
• Connecticut data breach notification rules
• What the Connecticut Data Privacy Act covers
• Steps to take after a data breach
• How to freeze your credit after a breach
• Identity theft law resources

---

Last updated: 2026-10-19. Details verified as of 2026-10-19.

Frequently Asked Questions

Can I claim money from Connecticut's $625,000 Frontier settlement?

No. The $625,000 is a payment to the State of Connecticut announced on October 16, 2026, not a consumer fund. The Attorney General's release describes a payment to the state plus injunctive security requirements, and it creates no claim form, eligibility test or deadline for individual residents.

Is the Frontier class settlement claim deadline still open?

No. Plaintiffs' September 26, 2025 motion for final approval in Wilson v. Frontier Communications Parent Inc., No. 3:24-cv-01418-L (N.D. Tex.), records a claim form deadline of October 27, 2025 and an opt-out and objection deadline of October 14, 2025. Both have passed.

How much was the Frontier class settlement and how many people did it cover?

The court's August 20, 2025 preliminary approval order approved a non-reversionary $5,640,000 common cash settlement fund. The magistrate judge's June 20, 2025 findings put the settlement class at 751,895 consumers who had applied to Frontier for residential services, and the September 26, 2025 motion for final approval counts 739,276 settlement class members.

Did Frontier admit it violated Connecticut law?

The Attorney General's October 16, 2026 release reports no admission by Frontier and no finding by a court or agency. It states that Connecticut's investigation identified multiple security failings, and it notes that Frontier and Verizon cooperated with the investigation. The settlement document itself was not publicly posted as of October 19, 2026, so its release and admission language cannot be read.

How fast must a company notify Connecticut residents of a data breach?

Under Conn. Gen. Stat. § 36a-701b(b)(1), notice must be made without unreasonable delay and not later than sixty days after discovery of the breach, unless a shorter period applies under federal law. The same subsection excuses notice where the person reasonably determines, after an appropriate investigation, that the breach will not likely result in harm to the affected individuals. Notice to the Connecticut Attorney General is due no later than the time notice goes to residents, under subsection (b)(2)(A).

Does Connecticut law give me free credit monitoring after a breach?

Where the exposed data includes a Social Security number or taxpayer identification number, Conn. Gen. Stat. § 36a-701b(b)(2)(B) requires the company to offer identity theft prevention services at no cost for not less than two years, and to tell the resident how to place a credit freeze on their credit file.

Can I sue a company myself under the Connecticut Data Privacy Act?

No. Conn. Gen. Stat. § 42-525(a) gives the Attorney General exclusive authority to enforce the CTDPA, and § 42-525(d) provides that nothing in the act supplies a basis for a private right of action. Section 42-471(e)(1) says the same for the Safeguards Law.

Does the Connecticut Data Privacy Act still give companies a chance to cure a violation first?

Not automatically. The mandatory 60-day cure notice under Conn. Gen. Stat. § 42-525(b)(1) applied only from July 1, 2023 through December 31, 2024. Since January 1, 2025, § 42-525(c) makes a cure opportunity discretionary, and the Attorney General may consider seven listed factors, including the substantial likelihood of injury to the public and the sensitivity of the data.

What security measures does the Connecticut settlement require Frontier to adopt?

Per the Attorney General's release: a comprehensive information security program with reporting to the CEO, employee training, an incident response plan, and specific safeguards covering document retention and deletion, logging and monitoring, segmentation, access controls, password management, multifactor authentication, encryption, risk assessments, penetration testing, antivirus maintenance, data loss prevention, component hardening, and intrusion and endpoint detection, plus a third-party assessment within one year of the effective date, with a copy to the Attorney General.