AT&T Data Breach Class Action Claims Telecom Giant “Disregarded” Customer Financial Safety

Lawsuit comes as a panel of federal judges prepare to hear oral arguments on May 30, over whether to consolidate all AT&T data breach claims before one judge for pretrial proceedings.

Class action lawsuits continue to be filed over an AT&T data breach that exposed the private information of tens of millions of customers on the internet, claiming the company failed to protect users’ data and warn them in a timely manner that their information was loose on the Dark Web.

Tiffany Sutherlin filed one of the most recent AT&T data breach claims in the U.S. District Court for the Eastern District of Missouri on May 27, alleging that the company first became aware of the massive leak in 2021, but denied the data breach had happened until March 2024, continuing to expose customers to unnecessary risk.

The complaint (PDF) seeks class action status to pursue damages on behalf of Sutherline and millions of other AT&T customers who now live under the threat of identity fraud, joining several dozen AT&T data breach lawsuits that have been filed in recent weeks.

The litigation emerged after information about the AT&T data breach was confirmed on March 30, indicating that customers’ names, addresses, phone numbers, Social Security numbers, and email addresses were exposed. However, the admission came only after hackers publicly posted the data on the Dark Web.

Sutherlin’s lawsuit claims that the cyber-attack, believed to have been perpetrated by a hacker group known as Shiny Hunters, compromised the company’s systems, allowing them to sell a database containing AT&T customers’ personal identifying information (PII).

Her complaint indicates Sutherlin was informed by a call from AT&T that her personal data had been obtained by unauthorized third parties. The data stolen included her name, address, phone number, date of birth, and Social Security Number. Since then she has had to make efforts to reduce the impact of the data breach on her life and finances.

“Defendant maintained, used, and shared the PII in a reckless manner,” the lawsuit states. “Defendant disregarded the rights of Plaintiff and Class Members by, inter alia, intentionally, willfully, recklessly, or negligently failing to take adequate and reasonable measures to ensure its data systems were protected against unauthorized intrusions; failing to take standard and reasonably available steps to prevent the Data Breach; and failing to provide Plaintiff and Class Members prompt and accurate notice of the Data Breach.”

Sutherlin presents claims of negligence, negligence per se, breach of implied contract, and unjust enrichment.

Pending AT&T Data Breach Lawsuit MDL Hearing

In response to the growing number of AT&T data breach lawsuits, a motion to transfer (PDF) was filed with the U.S. Judicial Panel on Multidistrict Litigation (JPML) in April, requesting claims filed throughout the federal district court system be consolidated for pretrial proceedings before one judge as part of an AT&T data breach lawsuit MDL (multidistrict litigation).

The JPML plans to hear oral arguments tomorrow on whether to create an AT&T data breach MDL, which has been supported by several plaintiffs and the telecom company itself.

Given the support of consolidation by several parties on both sides, it is likely that the JPML will hear few, if any, dissenting voices calling for the lawsuits to continue through individual pretrial proceedings.

If the JPML chooses to consolidate the lawsuits before one judge, pretrial proceedings will be coordinated to avoid duplicative discovery into common issues in the cases, and the court will likely establish a bellwether program where a small group of cases will be prioritized, to help gauge how juries may interpret expert testimony and evidence likely to be used in thousands of trials.