Judge Authorizes Direct Filing of AT&T Lawsuits Over Data Breach in Recently Established MDL

Lawsuits over the AT&T data breach from anywhere in the country can now be filed directly into the Northern District of Texas

The U.S. District Judge recently appointed to preside over all federal AT&T data breach lawsuits has approved a streamlined process that allows consumers to file claims against the telecom company over its failure to protect their personal data from hackers directly in the MDL (multidistrict litigation), avoiding delays associated with transfer claims brought in various different federal district courts nationwide.

Earlier this year, about 70 million customers began receiving notifications from AT&T that their personal identifying information (PII) had been stolen and sold on the Dark Web. This has led to dozens of lawsuits from consumers seeking financial damages, indicating AT&T appeared to be aware of the data breach as early as 2021, but did not warn affected customers until hackers began posting the evidence online.

AT&T confirmed the data breach on March 30, indicating that customers’ names, addresses, phone numbers, Social Security numbers, and email addresses were exposed. Since then, it has announced an even larger AT&T phone and text log data breach, involving cell phone and texting records affecting about 110 million customers.

Given common questions of fact and law raised in a rapidly growing number of complaints brought throughout the federal court system this year, the U.S. Judicial Panel on Multidistrict Litigation (JPML) established an AT&T data breach multidistrict litigation (MDL) last month, consolidating all complaints before U.S. District Judge Ada E. Brown in the Northern District of Texas, for coordinated discovery and pretrial proceedings.

To date, the MDL only includes claims involving the original data breach announced in March 2024. However, the litigation is expected to continue to rapidly grow and expand as more information is learned about this latest AT&T phone record data breach, which is also likely to result in a surge in lawsuits.

Direct Filing of AT&T Data Breach Lawsuits

In her first case management order (PDF) addressing the litigation, Judge Brown immediately cleared the way for plaintiffs, regardless of home state, to directly file AT&T data breach lawsuits with the MDL court in Northern Texas.

Direct filing streamlines the filing process by eliminating the need for plaintiffs to first file in their home state, then have the case transferred to the Northern District of Texas. If the pretrial proceedings do not result in an AT&T data breach settlement or other resolution, each individual lawsuit may later be returned back to the district where it originated for a separate trial date.

In addition, the order indicates Judge Brown is accepting applications from AT&T data breach attorneys to serve leadership roles in the litigation on the Plaintiff Steering Committee, which will take certain actions during the discovery process and pretrial proceedings that benefit all AT&T customers pursuing damages stemming from the data breach.

Following the selection of a Plaintiffs’ Steering Committee, Judge Brown indicates that the court will schedule a date for an initial status conference, which will likely involve a broader discussion about a coordinated schedule for discovery to uncover how the customer information was released, steps that could have been taken to prevent the breach, and how long AT&T knew about the problem.

If the parties fail to negotiate AT&T data breach lawsuit payouts for individual customers, it is likely that the Court will select a small group of representative cases to serve as early “bellwether” trials, which typically help the parties gauge how juries may respond to certain evidence and testimony that is likely to be repeated throughout the litigation.