AT&T disclosed two major data breaches: the 2019 incident affected about 65.4 million former customers and 7.6 million active accounts, exposing Social Security numbers and other data, prompting password resets; the 2024 breach affected nearly 109 million wireless customers, exposing call/text records, timestamps, location data, and was linked to UNC5537 in a Snowflake-targeting campaign.

A March 2024 disclosure put the 2019 breach at about 73 million current and former customers with sensitive data like Social Security numbers exposed from 2019 or earlier.

The 2024 breach, tied to UNC5537’s activity, exposed call/text records, timestamps, and location data for roughly 109 million wireless customers as part of Snowflake-related breaches.

Court-ordered settlements are being processed with potential payments issued within 60 days of final approval, though appeals could delay the timeline into early 2027.

If no appeals are filed, payments are expected to begin around December after claim reviews; the overall timing remains uncertain due to potential appeals.

The claims process continued even after the deadline, with final court approval possible if there is no appeal by November 2, and payouts could follow within 60 days.

About 4.9 million eligible customers filed claims, with more than 3.7 million expected to receive lower-tier payouts due to lack of documented losses.

Claim status updates are available through telecomdatasettlement.com and the helpline at 833-890-4930.

Ongoing monitoring and patching of affected systems are implied, with continued concern over Snowflake database exposure via third-party partners.

AT&T agreed to a $177 million settlement to compensate customers for the two breaches, allocating $149 million for the 2019 breach and $28 million for the 2024 breach, without admitting wrongdoing.

The UNC5537 hacker group claimed responsibility for the 2024 breach, with two individuals arrested; reports also mention affiliations with ShinyHunters in the broader case.

The breaches were not immediately disclosed publicly, and the 2024 breach involved Snowflake-based data, highlighting ongoing concerns about attackers targeting Snowflake servers via third-party partners.