A federal judge has granted preliminary approval for AT&T to settle numerous data breach lawsuits for $177 million. U.S. District Court Judge Ada E. Brown ruled that the settlement appears “fair, reasonable and adequate” and in the best interest of the plaintiffs.

The 147-page agreement aims to resolve consolidated lawsuits alleging AT&T failed to secure customer data, resulting in exposed personal information. A final hearing is scheduled for December, and the company has 30 days to outline additional data security measures to the plaintiffs. A formal notification program for victims will begin in August.

The settlement covers two separate incidents. The first involves a 2021 dataset leaked by the hacking group ShinyHunters and released publicly in March 2024, impacting 70 million customers. The second pertains to a breach of AT&T’s Snowflake account in April 2024, which exposed call and text records of 110 million customers. AT&T allegedly failed to use multifactor authentication for the Snowflake account, and the stolen data—which included names, addresses, emails, Social Security numbers, and birth dates—was leaked on a Russian hacking forum. The settlement allocates $149 million for the first incident and $28 million for the second, with affected individuals eligible for up to $5,000 and $2,500, respectively.

Beyond the settlement, AT&T agreed in September 2024 to pay $13 million to the FCC for failing to properly secure and manage customer data stored with third-party providers. Meanwhile, law enforcement has made several arrests connected to the breaches. Two individuals, Canadian Connor Riley Moucka and American John Binns, face federal charges for stealing data from Snowflake and extorting millions in cryptocurrency. In a related development, U.S. Army soldier Cameron John Wagenius was arrested for allegedly selling stolen phone records linked to the Snowflake data theft.