AT&T Class Action Lawsuit Alleges Security Failures Led to Release of Social Security Numbers, Customer Data on Dark Web

Failure to monitor its systems properly resulted in five year delay before customers were notified of AT&T security failures, lawsuit claims.

Another AT&T class action lawsuit has been filed over a massive data breach, which exposed tens of millions of customers’ names, social security numbers and other personal data to the Dark Web, leaving them vulnerable to identity theft by hackers.

The AT&T data breach occurred in 2021, when the hacker group Shiny Hunters claimed to have capitalized on AT&T security failures and were attempting to sell a database containing sensitive information. While AT&T originally denied the data breach, the company finally admitted to the theft on March 30, after a hacker known as “Major Nelson” released the contents of the database on the Dark Web for free.

According to AT&T, the exposed data dates back to 2019 and earlier. However, the company has yet to identify the source of the unauthorized access or provide details about the AT&T security failures that resulted in the release of customer’s social security numbers and other sensitive personal information.

Since then, a growing number of AT&T data breach class action lawsuits have been filed on behalf of all customers, and it is also expected the company will face individual lawsuits on behalf of specific consumers whose data was exposed.

A recent complaint (PDF) was filed by Mildred and James Kinchen on April 24, in the U.S. District Court for the Northern District of California. The lawsuit names AT&T Mobility LLC and AT&T Inc., as defendants, seeking class action status on behalf of themselves and other customers left vulnerable by the security failures.

According to the lawsuit, the California couple were wireless cellular telephone customers who have used AT&T’s services for personal use. Since the data breach was revealed, exposing their social security numbers and other financial data on the Dark Web, the couple indicates that they have had to take numerous actions to protect their financial security, including changes to bank accounts, changing of passwords, checking their credit score, and additional efforts to protect against hackers who now have their information.

The AT&T class action indicates that the security failures that resulted in the data breach have been known for years, but the company failed to take quick action to protect consumers’ identities.

“As a result of Defendants’ inability to properly secure Plaintiffs’ and the Class Members’ private Personal Information, data thieves were able to access and obtain the Personal Information of Plaintiffs and Class Members as early as 2019,” the Kinchen’s lawsuit states. ”For nearly five years, AT&T had knowledge of this threat and did not meaningfully act upon it until it publicly announced the veracity of the threat actor’s claims in March 2024 and told individual customers about the vulnerability as late as mid-April 2024.”

The complaint accuses AT&T of failing to properly monitor its computer network and systems, otherwise the data breach would have been discovered earlier, or the company would have been able to prevent it.

The lawsuit presents claims of negligence, negligence per se, breach of implied contract, unjust enrichment, and violations of California’s Unfair Competition Law and Consumer Privacy Act.

More than a dozen similar AT&T class action lawsuits over the data breach have already been filed, each raising similar allegations and seeking damages for different categories of customers. In addition, lawyers expect a number of individual claims to be pursued as well, seeking additional financial compensation for those who had their social security number or other sensitive information published.

Petition to Consolidate AT&T Data Breach Lawsuits

Given common questions of fact and law raised in complaints now being filed throughout the federal court system, a motion to transfer (PDF) was filed with the U.S. Judicial Panel on Multidistrict Litigation (JPML) earlier this month, requesting claims filed throughout the federal district court system be consolidated for pretrial proceedings before one judge as part of an AT&T data breach lawsuit MDL (multidistrict litigation).

The motion requests the litigation be consolidated in the Northern District of Texas, where the majority of complaints have been filed. According to the motion, eleven lawsuits are currently filed in the Northern District of Texas, while only one has been filed in the Western District of Oklahoma. This was before the Kinchens’ lawsuit was filed in Northern California.

The petition argues that due to the extensive nature of the data breach and the likelihood of the litigation to grow in the coming months and years, it is appropriate to centralize the claims to streamline the process, prevent inconsistent rulings, and facilitate the proceedings for both the court and the involved parties.

The JPML is scheduled to hear oral arguments on the motion at an upcoming hearing session scheduled for May 30, 2024, at the Orrin G. Hatch U.S. Courthouse in Salt Lake City, Utah. If the panel decides to consolidate the AT&T class action lawsuits, complaints filed throughout the federal court system will all be transferred to one judge for pretrial proceedings, to reduce duplicative discovery into common issues in the cases, avoid conflicting orders and serve the convenience of common witnesses, parties and the judicial system.