A US federal judge has granted preliminary approval for AT&T’s US$177 million settlement related to data breaches that occurred in 2024.

The breaches exposed the personal information of millions of customers.

US District Judge Ada Brown in Dallas ruled the settlement is fair and reasonable.

Under the agreement, affected customers will receive payments between US$2,500 and US$5,000 for direct losses.

Remaining funds will go to other customers whose data was compromised.

The FCC is investigating AT&T’s data security practices.

🔗 Source: Reuters

🧠 Food for thought

1️⃣ AT&T’s data breach history reveals escalating scale and impact

The recent $177 million settlement is just the latest chapter in AT&T’s long-running data security challenges that span over a decade.

In 2015, AT&T paid a $25 million civil penalty to the FCC after breaches at overseas call centers exposed data of approximately 280,000 customers, with the FCC describing it as the “largest ever” privacy case settlement at that time 1.

The company’s data security issues have grown dramatically in scale, from hundreds of thousands of affected customers in 2013-2015 to recent breaches impacting tens of millions, including one incident where approximately 109 million customer accounts were compromised 2.

This pattern of recurring breaches over multiple years suggests systemic challenges in AT&T’s data protection infrastructure despite multiple regulatory interventions and security improvements.

September 2023 saw AT&T agree to pay $13 million to resolve an FCC investigation into a January 2023 breach affecting 8.9 million wireless customers, demonstrating the ongoing nature of these security incidents 3.

2️⃣ Third-party vendor management remains telecommunications’ achilles heel

AT&T’s breaches consistently reveal vulnerabilities in their third-party ecosystem rather than direct attacks on core systems.