AT&T to Pay $177 Million to Settle Two 2024 Customer Data Breach Class Actions
AT&T will pay a total of $177 million to settle two class-action lawsuits related to customer data breaches that took place in 2024. The agreement was approved on October 2 by Judge Sidney Fitzwater in the Northern District of Texas.
The settlement amount is divided into two separate funds: $149 million for the first breach and $28 million for the second. These sums will also cover attorney fees and administrative expenses. The company did not admit any fault or wrongdoing as part of the resolution.
The first breach was publicly disclosed on March 30, 2024, and impacted approximately 73 million people, consisting of 7.6 million current customers and 65.4 million former customers. The exposed records dated from 2019 or earlier and had appeared on the dark web. Compromised data included names, addresses, phone numbers, dates of birth, account passwords, billing account numbers, and Social Security numbers for a portion of the affected individuals. AT&T stated it found no evidence of unauthorized access to its own systems.
The second incident originated from AT&T’s environment on the Snowflake cloud platform, with unauthorized access occurring between April 14 and 25, 2024. It affected nearly all mobile telephony customers and exposed phone numbers, counts of interactions, call durations, and cell tower identifiers. The records covered the period from May to October 2022, along with additional data from January 2, 2023. No Social Security numbers or the actual content of calls and messages were disclosed in this breach.
Under the terms of the settlement, eligible individuals may receive compensation of up to $5,000 for proven losses in the first case and up to $2,500 in the second case. The deadline for submitting claims was December 18, 2025.
Related articles
EY Confirms Data Breach Exposing Goldman Sachs and Man Group Client Details via Checkmarx Vulnerability
EY has confirmed a data breach involving client documents accessed through a third-party technology services management platform used to support its tax operations. The unauthorized access occurred via a vulnerability in Checkmarx software and lasted from March 28 to April 12, with detection only on April 23. Exposed information included names, addresses, tax identification numbers, email addresses, and financial details belonging to clients in Goldman Sachs wealth management and the Man Group investment fund. Neither Goldman Sachs nor Man Group systems were compromised, confirming the exposure originated solely from EY's environment. The leaked materials consisted of attachments from support tickets rather than core system data. EY has engaged independent security firms, notified regulators in California, Texas, Massachusetts, and Vermont, and offered credit monitoring to affected individuals.
ThreatMon Exposes SQL Server xp_cmdshell Abuse Stealing Credentials from Viva Aerobus
Researchers at ThreatMon discovered an exposed attacker infrastructure containing 17 attack tools and data stolen from airline Viva Aerobus. Attackers gained operating system access through the xp_cmdshell feature in SQL Server, which allows execution of system commands when enabled. They issued Windows and encoded PowerShell commands directly through database sessions. Data exfiltration occurred by reading files, splitting content into smaller chunks, converting to Base64, and returning results via normal SQL query responses to avoid network detection. Recovered materials included browser, Windows, and SQL credentials, source code, configuration files, database connection strings, OAuth, email, SFTP, and payment system references, plus connection history from SQL Server Management Studio. Activity took place between September 25 and 29, with no identified initial access vector or link to known malware families.
Times Car Breach Exposes Identity Documents of 1.6 Million Users
Times Mobility, operator of the Times Car car-sharing service under the Park24 group, confirmed a data breach affecting approximately 6.6 million accounts. The intrusion was detected on September 25, 2026, after unauthorized access to the company's systems. Leaked information includes names, addresses, phone numbers, dates of birth, email addresses, driver's license details, and hashed passwords. Most notably, images of identity verification documents were exposed for around 1.6 million accounts, covering driver's licenses, address proofs, student IDs, and family confirmation documents. The company is notifying affected members individually by email and plans further updates based on ongoing investigation results.
German Intelligence Deputy Chief's Personal Data Exposed for Years After LiveAuctioneers Breach
The personal phone number, email address, and home address of Dag Baer, deputy head of Germany's Federal Intelligence Service (BND), remained publicly accessible for several years following a 2020 breach of the American online auction platform LiveAuctioneers. The incident exposed data belonging to 3.4 million users and was uncovered through a joint investigation by Süddeutsche Zeitung and WDR. Baer continued using the compromised phone number until journalists contacted him on September 9, after which he acknowledged the error and stopped using the old number. Similar exposures affected a Bundeswehr general-major based in Bavaria as well as Peter Resink, head of the Dutch military intelligence service MIVD. All cases originated from third-party commercial services rather than direct compromises of intelligence agency systems. The reporting highlights how even senior intelligence officials remain vulnerable to ordinary consumer data breaches when they reuse contact details across personal accounts.