AT&T Data Breach Settlement Final Approval: $177 Million Deal Approved, $59 Million to Class Counsel

Yes: the AT&T data breach settlement received final approval on Friday, October 2, 2026, when the U.S. District Court for the Northern District of Texas approved the $177 million deal resolving MDL No. 3114 and awarded class counsel a combined $59 million in fees. Customers who filed one of the roughly 4.38 million claims will not be paid immediately; distribution begins only after the appeal period runs out and the Claims Administrator, Kroll Settlement Administration, finishes validating claims.

The order closes the longest open question in the case. The fairness hearing took place on January 15, 2026, and for almost nine months the parties, the objectors, and millions of class members waited on a ruling. In that time the Multidistrict Litigation (MDL) changed judges. It was reassigned in August from Judge Ada E. Brown to Senior District Judge Sidney A. Fitzwater. The fee award, one-third of each fund, sits at the top of the range courts in the Fifth Circuit accept for common-fund recoveries. With the approval entered, the next date that matters is the deadline to appeal.

AT&T data breach settlement final approval: what the court did on October 2

The case is In re AT&T Inc. Customer Data Security Breach Litigation, No. 3:24-md-03114 in the Northern District of Texas. The final approval order does three things. It certifies the two settlement classes for settlement purposes. It finds under Rule 23(e)(2) that the settlement is fair, reasonable, and adequate. And it grants class counsel's Rule 23(h) motion for fees and costs. Law360 reported on October 2 that the court approved the settlement and awarded a combined $59 million to the lawyers for the two classes. CFO Dive and other outlets carried the same figures.

The settlement was always two deals in one document, because AT&T disclosed two unrelated incidents in 2024:

• AT&T 1 (the March 2024 incident). AT&T announced that a dataset containing customer information dated 2019 or earlier had been released on the dark web. The company said it affected about 7.6 million current account holders and 65.4 million former account holders. The exposed fields included names, addresses, phone numbers, dates of birth, account numbers, passcodes, and, for some customers, Social Security numbers. The Judicial Panel on Multidistrict Litigation (JPML) built MDL No. 3114 around this incident. Its 2024 transfer order sent the cases to Judge Brown in Dallas.
• AT&T 2 (the July 2024 incident). AT&T disclosed that records of customer calls and texts had been copied from a third-party cloud workspace hosted on Snowflake. The records were metadata, not content: numbers called and texted, interaction counts, call durations, and for some records cell-site identifiers. Coverage of the settlement puts the affected population at roughly 109 to 110 million wireless customers, nearly every AT&T customer at the time.

The two incidents produced two separate Settlement Class definitions and two non-reversionary funds: $149 million for AT&T 1 and $28 million for AT&T 2. Because the funds are non-reversionary, none of the money returns to AT&T, however many claims are paid.

Who qualifies for the AT&T $177 million settlement?

Class membership turns on notice. A person is in the AT&T 1 class if AT&T identified their information in the March 2024 dataset. A person is in the AT&T 2 class if they were an AT&T customer whose call or text records were in the Snowflake download. People in both classes are "overlap" class members. Class Notice went out in 2025 after the June 2025 preliminary approval order. The deadline to opt out or object was November 17, 2025.

Membership alone is not enough to be paid. A class member had to file a claim, and that deadline has passed. It was first set for November 18, 2025 and later extended to December 18, 2025.

Feature	AT&T 1 Settlement Class	AT&T 2 Settlement Class
Incident	Dark-web dataset (records dated 2019 or earlier), disclosed March 2024	Snowflake call/text metadata, disclosed July 2024
Approximate size	7.6M current + 65.4M former account holders	~109–110M customers
Fund	$149,000,000	$28,000,000
Documented-loss cap	Up to $5,000	Up to $2,500 (losses on or after April 14, 2024)
Flat cash option	Tier 1 (SSN exposed) or Tier 2 (no SSN); Tier 1 = 5 × Tier 2	Tier 3 pro rata payment
Fee awarded (requested split)	$49.67M to the Lanier Law Firm team	$9.33M to the Kopelowitz Ostrow team
Fee as share of fund	33.3%	33.3%
Overlap maximum	Up to $7,500 combined across both funds

Two choices determined each claimant's payment. In AT&T 1, a claimant could seek reimbursement of documented losses up to $5,000, or take a flat pro rata cash payment. In the flat option, people whose Social Security number was exposed (Tier 1) receive five times the amount paid to people whose number was not (Tier 2). In AT&T 2, a claimant could seek documented losses up to $2,500 or take a Tier 3 pro rata payment. The $7,500 figure in many headlines is the sum of the two documented-loss caps. Only an overlap class member with $7,500 in documented, traceable losses could receive it. The typical claimant will get much less.

How much will I get from the AT&T data breach settlement?

No one can give a per-person amount yet, and Kroll has not published one. Every flat payment is pro rata. It depends on what is left in each fund after fees, costs, notice and administration expenses, any service awards to class representatives, and documented-loss payouts, divided among the valid claims that Kroll approves. Claims run in the low millions while the funds total $177 million, so the flat payments are likely to be small.

The claims figures give a starting point. About 4.38 million claims had been submitted by December 30, 2025, which coverage of the claims process puts at a claims rate of about 4.8 percent. That is high for a data breach settlement but still a small fraction of a class of well over 100 million people. Kroll has not said how those claims divide between the two classes or between documented-loss and flat payments.

The table below is arithmetic, not a forecast. It subtracts the requested fee split and the cost caps (up to $564,792 for the AT&T 1 team and up to $231,438 for the AT&T 2 team) and divides the remainder by hypothetical numbers of valid claims. It leaves out administration costs, service awards, documented-loss payments, and the Tier 1/Tier 2 weighting. Each of those lowers the real flat payment below these figures.

Valid claims on the fund	AT&T 1: ~$98.77M after fees and costs	AT&T 2: ~$18.44M after fees and costs
1,000,000	~$98.77 per claim	~$18.44 per claim
2,000,000	~$49.38 per claim	~$9.22 per claim
3,000,000	~$32.92 per claim	~$6.15 per claim
4,000,000	~$24.69 per claim	~$4.61 per claim

Two points follow from the math. First, the fee award moves every flat payment by about a third. A 25 percent fee instead of 33.3 percent would have added roughly $12.4 million to the AT&T 1 net fund and $2.3 million to the AT&T 2 net fund. Second, the AT&T 2 fund is small compared with its class. The Snowflake class is about 50 percent larger than the AT&T 1 class but has less than a fifth of the money. That reflects the parties' view that call metadata is less harmful than Social Security numbers. It was also one of the objectors' main complaints.

How much did the lawyers get in the AT&T settlement?

Class counsel received a combined $59 million, one-third of the $177 million fund. Each team was paid from its own fund. The fee motions asked for $49.67 million for the Lanier Law Firm group on the AT&T 1 fund, led by W. Mark Lanier. They asked for $9.33 million for the group led by Jeff Ostrow of Kopelowitz Ostrow on the AT&T 2 fund. They also sought up to $564,792 and $231,438 in costs. In both cases the fee is exactly one-third of the fund. Counsel told the court that common-fund fees of 25 to 35 percent are standard in complex class litigation.

The Fifth Circuit allows that. In Union Asset Management Holding A.G. v. Dell, Inc., 669 F.3d 632 (5th Cir. 2012), it approved the percentage method for common-fund cases, provided the district court checks the result against the twelve factors from Johnson v. Georgia Highway Express, Inc., 488 F.2d 714 (5th Cir. 1974). Those factors include time and labor, the novelty and difficulty of the questions, the skill required, awards in similar cases, and the results obtained. Under the Common Fund Doctrine the fee comes out of the class recovery and is not paid on top of it by AT&T. That is why the fee percentage drives the per-claimant numbers above.

The one-third award matters for two reasons. In very large funds, federal courts often apply lower percentages as the fund grows, on the theory that size reflects the number of class members more than the lawyers' work. A $177 million fund is large but not a megafund, and the court did not reduce the fee on that basis. Also, a one-third common-fund fee approved on a fully briefed record with objectors present is the kind of award that class counsel in other data breach MDLs will cite in their own fee motions. Whether it holds up depends on whether anyone appeals.

Why was the AT&T settlement approval delayed so long?

The public record does not explain the delay, and the court has given no reasons. What the docket does show is a long fairness hearing, a contested fee request, objectors, and a change of judge.

Date	Event
March 2024	AT&T discloses the dark-web dataset (AT&T 1)
July 2024	AT&T discloses the Snowflake call/text records incident (AT&T 2)
2024	JPML creates MDL No. 3114 and transfers cases to Judge Ada E. Brown, N.D. Tex.
June 2025	Preliminary approval order; $149M + $28M funds
November 17, 2025	Opt-out and objection deadline
December 18, 2025	Claims deadline (extended from November 18)
December 30, 2025	About 4.38 million claims reported submitted
January 15, 2026	Six-hour final approval hearing with testimony from counsel and objectors
August 14, 2026	Docket entry records Judge Brown's recusal (later marked docketed in error)
August 17, 2026	MDL reassigned to Senior District Judge Sidney A. Fitzwater
October 2, 2026	Final approval granted; $59M combined fee award
November 2, 2026	Notice-of-appeal deadline if final judgment entered October 2 (FRAP 4(a)(1)(A) and 26(a)(1)(C))

The January 15 hearing lasted about six hours, which is long for a fairness hearing. The court took testimony from plaintiffs' lawyers, defense counsel, and objectors on the fairness of the settlement and on the one-third fee request. A group known as the "Udell Objectors" appeared before the hearing. Discovery disputes connected to them were resolved and the related motions were denied as moot in January 2026.

The judge change came in August. On August 14, 2026, a docket entry recorded that Judge Brown had recused and that the clerk had reassigned the case. That entry was later marked as docketed in error. On August 17, the litigation was reassigned to Senior Judge Fitzwater, a Dallas judge with decades on the bench and long experience with complex commercial and class cases. The reasons for the recusal have not been made public, and this report does not speculate about them. The final approval order came about seven weeks after the reassignment. Judge Brown heard the fairness evidence, but the court that ruled on it had a new presiding judge.

What did the objectors argue?

Class members who object to a class settlement can be heard at the fairness hearing and may appeal approval. Here the main objection was to the size of the recovery. One objection, filed by counsel for more than 4,000 AT&T customers (Docket Entry 370), made three arguments:

1. The total is too low. The objectors said the $177 million fund and the individual amounts available are disproportionate to the scale and length of the harm.
2. Double-breach victims are not compensated twice. Many customers were affected by both incidents. The objectors argued that the distribution plan does not give extra compensation to people whose data was compromised twice. The settlement's answer is the overlap structure: an overlap member can claim from both funds, up to $7,500 in documented losses combined. It does not include a separate premium for being affected twice.
3. Actual harm goes uncompensated. The objectors said the individual payments do not match real losses, such as time spent on fraud monitoring and the lasting risk created by exposed Social Security numbers.

By approving the settlement, the court necessarily rejected those objections under Rule 23(e)(2). That rule asks whether class representatives and counsel adequately represented the class, whether the deal was negotiated at arm's length, whether the relief is adequate given the costs, risks, and delay of trial and appeal, and whether class members are treated equitably relative to each other. The last factor is the one the double-breach objection targets directly. It is also the most likely subject of any appeal.

Can objectors appeal the AT&T settlement approval, and would that delay payments?

Yes. An Objector who appeared and objected can appeal final approval or the fee award to the U.S. Court of Appeals for the Fifth Circuit, and an appeal would postpone payments. Under Federal Rule of Appellate Procedure 4(a)(1)(A), a notice of appeal in a civil case is due within 30 days after entry of judgment. Thirty days after October 2, 2026 is Sunday, November 1. Under FRAP 26(a)(1)(C), the deadline therefore moves to Monday, November 2, 2026, assuming final judgment was entered on October 2. A timely post-judgment motion under FRAP 4(a)(4) would restart that clock.

An appeal matters to class members because of how the settlement defines its Effective Date. The Effective Date arrives only after the time to appeal has expired. If an appeal is filed, it is pushed back until the last appellate court affirms approval or the appeal is dismissed. Kroll's distribution is tied to the Effective Date. One objector's notice of appeal can therefore hold back payments to millions of claimants for the year or more a Fifth Circuit appeal usually takes.

Rule 23(e)(5)(B) addresses one abuse in this process. Since the 2018 amendments, no payment may be made to an objector or objector's counsel in exchange for dropping an objection or abandoning an appeal unless the district court approves it after a hearing. That rule limits the use of appeals by professional objectors to extract side payments. Objectors who believe the double-breach allocation or the one-third fee is wrong can still appeal.

When will AT&T settlement payments be sent?

No payment date has been announced. The settlement website has said that payments require three things: final approval, the end of the appeal period (and of any appeal), and completion of Kroll's claim review. The first is now done. If no notice of appeal is filed by about November 2, 2026, the Effective Date follows, and Kroll can finish validating claims, calculate the pro rata amounts, and begin sending payments by the method each claimant chose. Kroll has not committed to a distribution date, and none should be inferred. If an appeal is filed, payments will likely wait until the Fifth Circuit rules.

Claimants should watch the official settlement website and Kroll's communications. Sites that promise a specific payout date or ask for fees to "speed up" a payment should be treated with suspicion. Nothing in the settlement allows paying anyone to move a claim forward.

Can I still file a claim in the AT&T data breach settlement?

No. The claims deadline was December 18, 2025, and final approval does not reopen it. A class member who did not opt out by November 17, 2025 and did not file a claim is bound by the settlement's release and receives nothing from it. That is how an opt-out Rule 23(b)(3) Class Action works. Class members who opted out kept their individual claims against AT&T. They would now have to pursue them separately, subject to AT&T's consumer Arbitration Agreement.

Why could AT&T customers sue as a class when AT&T has an arbitration clause?

AT&T's wireless customer agreement contains a well-known arbitration clause with a Class Action Waiver. It is the clause the Supreme Court enforced in AT&T Mobility LLC v. Concepcion, 563 U.S. 333 (2011), which held that the Federal Arbitration Act preempts state rules treating consumer class waivers as unconscionable. So how did more than 100 million customers resolve their claims in one federal Settlement Class?

The answer is that a settlement class is consensual. An arbitration clause is a defense the company can choose to assert. It is not a limit on the court's jurisdiction, and a defendant may agree to resolve claims class-wide when that is cheaper than the alternative. For AT&T the alternative was real. Many class members were former customers whose arbitration obligations might be disputed. The MDL included claims from multiple districts. And a defendant that insists on individual arbitration against a well-organized plaintiffs' bar risks Mass Arbitration, where per-case filing and arbitrator fees across hundreds of thousands of demands can exceed a negotiated class fund. A single $177 million payment with a full class release gave AT&T certainty that a series of motions to compel arbitration could not.

The contrast with another ruling the same day is clear. Also on October 2, 2026, Judge Randolph D. Moss of the U.S. District Court for the District of Columbia granted motions by AT&T, Verizon, and T-Mobile to compel arbitration of a putative antitrust class action over Wi-Fi calling. He ruled that challenges to the carriers' arbitration agreements must themselves be decided by the arbitrator. The same contract terms that sent those consumers to individual arbitration were set aside, by agreement, in the data breach settlement. Carriers use the arbitration clause when it helps them and settle around it when it does not.

What the AT&T data breach settlement final approval means for each audience

For defendants facing data breach MDLs. The approval confirms that a settlement split into separate funds for separate incidents, with separate classes and separate counsel teams, can survive objection even when the two class populations overlap heavily. It also shows the cost of that design. Objectors focused on the overlap, and a court that wants to approve the deal has to explain why people harmed twice are not paid a premium. Defense counsel structuring multi-incident settlements should expect a Rule 23(e)(2)(D) equitable-treatment challenge and build a record on allocation.

For plaintiffs' firms and class counsel. A one-third fee on a $177 million fund, awarded after a contested six-hour hearing, is useful precedent in the Fifth Circuit and beyond. The fees also became payable only after about nine months of delay and a change of judge, and they may be held up further by an appeal. That carrying cost falls on firms that advanced the work under a Contingency Fee model and, in some cases, on Third-Party Litigation Funding behind them. Firms should account for the gap between a fairness hearing and an approval order when they price a data breach docket.

For class members. The ruling makes payment likely but not immediate. The amount each person receives is fixed by the pro rata structure, the one-third fee, and the number of valid claims, and the table above shows how quickly those factors reduce the flat payments. Claimants who chose documented losses will be paid according to Kroll's validation of their documents. Anyone who did not file by December 18, 2025 has no further claim against the fund.

For objectors and their counsel. The appeal window closes about November 2, 2026, if judgment entered on October 2. Because of Rule 23(e)(5)(B), an appeal can no longer be quietly settled for a side payment without court approval. The equitable-treatment objection about the double-breach allocation is the issue most likely to get serious attention on appeal.

FAQ

Did the AT&T data breach settlement get final approval?

Yes. The Northern District of Texas granted final approval to the $177 million settlement in MDL No. 3114 on October 2, 2026, after a January 15, 2026 fairness hearing and the August 17, 2026 reassignment of the case to Senior District Judge Sidney A. Fitzwater.

How much will I get from the AT&T data breach settlement?

The amount is not yet known. Documented-loss claims are capped at $5,000 for AT&T 1 and $2,500 for AT&T 2 ($7,500 for overlap members). Flat payments are pro rata shares of what remains after the $59 million fee, costs, and administration expenses, split among about 4.38 million claims, so most flat payments are likely to be small.

When will AT&T settlement payments be sent?

No date has been set. Payments follow the Effective Date, which comes after the appeal deadline (about November 2, 2026, if judgment entered October 2) passes with no appeal, or after any appeal ends, and after Kroll finishes reviewing claims.

How much did the lawyers get in the AT&T settlement?

The court awarded $59 million in fees, one-third of each fund. The request was $49.67 million to the Lanier Law Firm team from the $149 million AT&T 1 fund and $9.33 million to the Kopelowitz Ostrow team from the $28 million AT&T 2 fund, plus costs.

Can I still file a claim in the AT&T settlement?

No. The claims deadline was December 18, 2025, and the opt-out and objection deadline was November 17, 2025. Final approval does not reopen either deadline.

Who was the judge in the AT&T data breach MDL?

The JPML first assigned MDL No. 3114 to Judge Ada E. Brown, who held the January 15, 2026 fairness hearing. After a recusal entry on August 14, 2026, the litigation was reassigned on August 17, 2026 to Senior District Judge Sidney A. Fitzwater, who was presiding when final approval was granted.