The AT&T data breaches of 2024: what leaked and what to do now

People often talk about "the AT&T breach" as one event. It was two, announced months apart, with different data and different consequences. Working out which one touched you decides what you should do.

Sources: AT&T's March 30, 2024 statement, AT&T's Form 8-K filed July 12, 2024 and the data elements listed on the court-authorized settlement website.

This is the one that matters most for identity theft, because for some people it included a Social Security number and a date of birth. AT&T said at the time that it did not know whether the data came from AT&T or one of its vendors, and that it would contact affected people and offer credit monitoring where applicable. If you got a letter, it should say which of your details were in the set.

1. Freeze your credit at Equifax, Experian and TransUnion. It is free, takes a few minutes per bureau online, and stops new accounts being opened in your name. Our credit freeze guide has the links and the steps.
2. Change your AT&T account passcode and password. Passcodes were among the leaked fields. A passcode is what a caller or store uses to prove they are you, so an old one is a step toward a SIM swap. Add a separate wireless account lock if your carrier offers one.
3. Get an IRS Identity Protection PIN. A name, date of birth and SSN are what a fake tax return needs. The IP PIN guide takes five minutes.
4. Check your free credit reports at AnnualCreditReport.com for accounts you do not recognize. See how to get and read them.

The data was described as from 2019 or earlier, and much of it is a former customer list. Being a former customer does not mean you are safe; it means the address and phone on file may be old, while your SSN and date of birth have not changed.

According to AT&T's SEC filing, attackers took files from an AT&T workspace on a third-party cloud platform between April 14 and April 25, 2024. The files held records of calls and texts, not their content. The settlement website identifies the platform as Snowflake. AT&T said the data did not include names, but noted that names can often be found for a phone number using public tools.

No SSN means a credit freeze is not specifically called for by this incident, though it is still a good idea for almost everyone. The realistic risks are different:

• Targeted scams. Someone who knows who you talk to can impersonate a relative, your doctor's office or your bank with uncomfortable accuracy. Treat any urgent call or text asking for money or codes as suspect, and call back on a number you already have. Our imposter scams guide covers the patterns.
• Location history. Cell site IDs for a subset of records can show roughly where a phone was. If you have a safety concern about someone tracking you, talk to a domestic violence advocate or local law enforcement about your situation.

Lawsuits over both incidents were settled together in the U.S. District Court for the Northern District of Texas, case number 3:24-md-03114-E. According to the court-authorized settlement website, run by Kroll Settlement Administration, class members could claim documented losses of up to $5,000 for the March 2024 incident or up to $2,500 for the July 2024 incident, or a pro rata cash payment instead. The claim deadline was December 18, 2025, and a final approval hearing was set for January 15, 2026.

Payments are made only after court approval and after any appeals are resolved. If you filed a claim, check status on that site and nowhere else.

If an account was opened in your name, a tax return was filed using your SSN, or your phone number was moved to a new SIM without your say-so, report it at IdentityTheft.gov to get a recovery plan and an FTC report, and contact the business involved. Our step-by-step identity theft recovery plan covers the order to do things in, and the general data breach triage guide covers other kinds of leaked data.