Class Action Lawsuit Filed Over Latest AT&T Data Breach Releasing Customers’ Phone Records

Lawsuit claims customers face increased risks of identity theft, fraud and blackmail in the wake of a massive AT&T phone records data breach.

AT&T faces a class action lawsuit over a recently-announced data breach, which involved the release of phone and text records for about 110 million customers, marking the second major cybersecurity failure involving the telecom company announced this year.

Dina Winger filed the complaint (PDF) against AT&T Inc. in the U.S. District Court for the Northern District of Texas on July 12, the same day the data breach was announced, seeking class action status to pursue damages on behalf of all affected customers.

The company first announced the phone records data breach in a report to the Securities and Exchange Commission, following it with a press release to customers detailing its ongoing investigation into the hack, which apparently occurred several years ago. AT&T indicates that the data included phone call and text message records involving nearly all AT&T cellular customers from May 1, 2022, to October 31, 2022, and again on January 2, 2023.

Although the company maintains that the data has not been publicly released or sold on the Dark Web, the lawsuit maintains the the breach poses a serious risk for consumers.

“The stolen logs contain a record of virtually every number AT&T customers called or texted – including customers of other wireless networks – the number of times they interacted and the call duration. Records of customers in January of 2023 may also be implicated, as well as AT&T landline customers who interacted with those cell numbers,” Winger’s lawsuit notes. “The foregoing data is personally identifiable information (PII) and is valuable and sensitive.”

Winger, of Florida, indicates she and other affected customers face an increased risk that they will suffer identify theft, fraud or even blackmail due to the theft of the personal information.

She argues that AT&T failed to adequately protect consumers’ data and failed to warn them of the problem in a timely manner.

Law enforcement is continuing to investigate the AT&T phone records breach, and at least one arrest has already been made.

AT&T ShinyHunters Data Breach

This is the second major AT&T data breach announced in recent months. The earlier reported hack, conducted by an online group known as ShinyHunters, led to more than 70 million customers’ personal identifying information (PII) being leaked on the Dark Web, including names, email addresses, social security numbers and other data.

A growing number individuals who have already signed up for the AT&T data breach lawsuits over that incident are raising allegations that the company knew about the leaked data for years and failed to notify customers, exposing them to an increased risk of financial fraud. Those lawsuits indicate that those hackers gained access to the personal information of customers as early as August 2021, and publicly posted customer information on the Dark Web months ago.

However, AT&T notice letters regarding the breach just recently started to be sent earlier this year, so the size and scope of the litigation is expected to continue to increase dramatically in the coming months.

Given common questions of fact and law raised in a growing number of complaints already filed over the breach caused by ShinyHunters, the U.S. Judicial Panel on Multidistrict Litigation (JPML) established an AT&T data breach multidistrict litigation (MDL) last month, consolidating all complaints filed through the federal district court system in the U.S. District Court for the Northern District of Texas under Judge Ada E, Brown, who oversee coordinated pretrial proceedings.

So far, the claims included in the MDL do not involve lawsuits over the newer AT&T call record data breach announced more recently. It is unclear whether the class action lawsuit filed by Winger and other customers who had their phone records released will be centralized as part of the same MDL, or whether a separate consolidated proceeding will be established.