AT&T Data Breach Settlement Payout Date: None Set, and the Official Site Now Says Not in 2026

No AT&T data breach settlement payout date has been set as of November 2, 2026. Kroll’s October 30, 2026 update on the official site says the court granted final approval on October 2, payments have not been issued, and they are not expected in 2026. Court-quoted estimates run from $6.50 to $40.

When will AT&T settlement payments be sent?

Nobody official has published a date, so any calendar date you see elsewhere is someone’s estimate. At least one syndicated news story projected payments from December 2026 to early 2027; Kroll’s October 30 update, which is newer and is the administrator’s own statement, says not in 2026. Here is every official statement on timing that we could read.

Two cautions on those sources. FAQ 10, FAQ 19 and the Important Dates panel on the same site still say the court has not decided, which the October 30 banner and the October 2 opinion have overtaken, so trust the banner. And we read the opinion from the site’s Documents tab, not from PACER, so we cannot tell you whether anyone has filed a notice of appeal or a post-judgment motion. Federal appellate Rule 4 generally allows 30 days after entry of the judgment or order in a civil case, and approximately 45 objectors were before the court, but neither fact sets a payout date.

What still has to happen, in order

1. The time to appeal ends, and any post-judgment motions or appeals are resolved.
2. The Effective Date arrives under paragraph 69.
3. AT&T funds the rest of the settlement within 15 days of the Effective Date (paragraph 119).
4. Kroll pays by Venmo, direct deposit or paper check within 60 days of the Effective Date (paragraphs 173 and 174). Paper checks must be negotiated within 180 days.

How much will I get?

You will get either a documented-loss payment or a tier payment, not a fixed sum. The tier figures below are Kroll’s estimates as quoted by the court, “contingent on certain variables,” and the opinion warns the claim counts may change as deficient claims are resolved.

The opinion labels the $7.50 to $8.10 line “AT&T 2 – Tier 2.” The settlement agreement and site place Tier 2 in AT&T 1, and the agreement’s rule that Tier 1 pays five times Tier 2 fits those numbers, so we treat the label as a slip. Allowed tier claims can overlap, because a person in both classes may claim in each.

A person in both classes can claim in each, and for documented losses the paperwork must be different for each incident. Adding the top of Tier 1 and Tier 3 gives $47.10 by our arithmetic, which is a sum of estimates and not a promised amount. Losses you cannot claim, per FAQ 32, include medical bills, emotional distress, estimated lost wages or time, and credit score reductions.

The tier estimates imply $80.0M to $83.0M in tier payments against $94.7M left after fees, costs, service awards and administration. The gap of $11.8M to $14.8M is what the documents leave for documented-loss payments, taxes and any cost growth. Under the court’s change, any money left over goes first to further payments to claimants where feasible, and only then to a charity with a substantial link to privacy, cybersecurity, consumer protection or access to justice. No funds return to AT&T.

Claim deadlines: can I still file?

No. Every deadline for a new claim has passed, and the site says claims can no longer be submitted. Later dates apply only to people who already filed and received a notice.

The fraud screen removed a large share of filings. Of 4,918,073 claims, 1,099,732 were rejected, and 804,381 of those, or 16.4%, were declined for fraud by ClaimScore, doing business as Covalynt, not by Kroll. If you get a notice, check it. The site says its email notices came from attsettlement@e.emailksa.com and gives (833) 890-4930 to confirm. It also says a valid claimant need do nothing further, so treat any request for a fee or a Social Security number as suspect.

How do I know if I was affected?

Two incidents sit under one settlement, with different data and different people. The class records came to 99,763,302 for notice purposes: 57,002,042 in AT&T 1 only, 36,478,626 in AT&T 2 only, and 6,282,634 in both. FAQ 29 names what counts as proof: a notice from AT&T in March or April 2024 with your name on it (AT&T 1), a notice with your name about call and text records (AT&T 2), or a Class Member ID from a 2025 postcard or email. Being on those lists now matters only for your own risk, because the claim window has closed.

MVNO users count too: FAQ 26 treats customers of carriers on AT&T’s network as line or end users, who qualify only for a documented-loss payment. The 42,761,260 figure is a notice list, not a count of affected lines, and the documents do not reconcile it with the 8-K’s “nearly all.” If your Social Security number was in the first set, consider a credit freeze, and our state-by-state identity theft data shows which report types are common where you live.

Five counts for one incident

The 73 million figure comes from AT&T’s first statement. The documents give five figures, and only one gap is explained: Kroll’s declaration attributes the fall from records to members to duplication in the data.

Maine’s portal has been offline since June 2026, so we did not read its copy. April 2024 reporting on the Maine filing cites more than 51 million, matching Indiana. Under AT&T’s name, each of these four state lists shows only this 2024 notice for that year, and none for the July 2024 call records.

Every AT&T data incident, dated

AT&T has now been through two FCC breach consent decrees and one class settlement in this record, and the 2023 vendor breach is often confused with the 2024 pair. It is not part of the $177 million. The FCC’s DA 24-892 says 8,931,656 AT&T Mobility customers were affected, using data AT&T shared with the vendor from 2015 to 2017 and which should have been destroyed or returned years earlier. For how the 8-K fits with other companies’ filings, see every Item 1.05 disclosure, and for this year’s filings see the 2026 cyber attacks tracker.

The national-security delay

The July 2024 8-K invokes the national-security delay in Item 1.05(c). It states: “On May 9, 2024, and again on June 5, 2024, the U.S. Department of Justice determined that, under Item 1.05(c) of Form 8-K, a delay in providing public disclosure was warranted.” AT&T learned of the claim on April 19 and filed on July 12, 84 days later. An FBI spokesperson told TechCrunch that the delays cited “potential risks to national security and/or public safety.” We read that statement through TechCrunch’s report; we did not find an FBI web page carrying it.

Arrests and charges: what the documents do and do not say

AT&T’s 8-K says “at least one person has been apprehended” and names no one. The October 10, 2024 indictment of Connor Moucka and John Binns calls the cloud provider Victim-1 and describes Victim-2 only as “a major telecommunications company located in the United States.” DOJ’s August 5, 2026 release says Moucka pleaded guilty to four counts over at least 165 customers of a U.S. software-as-a-service company, using stolen credentials, with over $2.5 million in ransom paid. It set sentencing for October 27, 2026, and we could not confirm the outcome. DOJ’s case page, last updated August 7, 2026, says Binns is not in U.S. custody. DOJ’s September 25, 2026 release says former soldier Cameron Wagenius received 70 months and $294,978 in restitution for conspiring to hack telecommunications companies, and that he posted stolen call detail records of a government official. None of these DOJ documents, as far as we read them, names AT&T or Snowflake. News reports make the link. AT&T’s 8-K and July statement say only “third-party cloud platform,” while the settlement documents name Snowflake, Inc. but no hacker. So we do not state here that any of these men stole the AT&T records. AT&T settled without any admission of liability or wrongdoing, per the settlement notice.

What this means for MSPs

The practical risk for client businesses is not the $6.50. It is that a phone-number-to-contact graph, plus old passcodes and Social Security numbers, makes help-desk and carrier impersonation easier. Specific checks:

• Carrier account PINs. The AT&T 1 data included account passcodes, and TechCrunch reported AT&T reset them after being told on March 26, 2024 that they were easy to decipher. List every client business line on AT&T, Cricket or an MVNO on AT&T’s network, confirm a fresh account PIN, and confirm who at the client is authorized to change it.
• SIM-swap and port-out locks. The FCC’s November 2023 order (FCC 23-95) requires wireless providers to use secure authentication before moving a number and to notify customers immediately of a SIM change or port-out request. Ask each carrier rep where those notices go for a business account, and make sure they reach a monitored mailbox instead of the phone being attacked.
• SMS as a second factor. AT&T told the FCC that porting, SIM swap and equipment fraud rates for customers in the 2023 vendor breach ran below its general population. That is AT&T’s own measure on one breach, so do not treat it as clearance. Move admin and finance accounts off SMS codes first, since the number is what these attacks take.
• Help-desk call-backs. The stolen records show who called whom, how often, and for some records the cell site. Attackers can use that to sound familiar. Require call-backs to a number on file for password resets and payment changes, and do not accept a matching caller ID as proof.
• Vendor data retention. The FCC penalty turned on data that sat at a vendor years past its contract, and DA 24-892 now requires AT&T to track data shared with vendors and enforce disposal. Do the same for clients: list former vendors that still hold customer data, then ask for written proof of deletion.
• SaaS data platforms. DOJ describes the campaign as stolen credentials used on customers of one cloud platform. Check every client’s cloud data warehouse for accounts without multifactor authentication, stale service credentials and missing network restrictions, and pull the audit logs before retention expires.
• Client questions. Tell clients that business accounts are not a route back in: AT&T 1 claims from ineligible businesses were rejected (FAQ 35), and an account owner’s AT&T 2 claim window closed December 18, 2025. Warn staff about settlement phishing, given the 4.9M claims in play. For wider context on what leaked data now contains, our data breach statistics track fields such as phone numbers across reported breaches.

Frequently asked questions

What is the AT&T data breach settlement payout date?

No payout date has been set as of November 2, 2026. The official settlement site’s October 30, 2026 update says payments have not been issued, cannot be made until the settlement becomes effective, and are not expected to be issued in 2026.

How much will I get from the AT&T settlement?

The court’s October 2, 2026 opinion repeats Kroll’s estimates, which depend on certain variables: $39 to $40 for Tier 1 (Social Security number in the March 2024 data), $7.50 to $8.10 for Tier 2 (other March 2024 data), and $6.50 to $7.10 for Tier 3 (July 2024 call records). Documented-loss claims are capped at $5,000 and $2,500.

Can I still file a claim in the AT&T settlement?

No. The claim deadline was December 18, 2025, and the site’s October 30, 2026 update says claims can no longer be submitted. The opt-out and objection deadline was November 17, 2025.

How do I know if I was affected by the AT&T data breach?

Look for an AT&T notice from March or April 2024 (personal data) or a notice about call and text records, or a Class Member ID on a 2025 postcard or email from the administrator. The site lists those as proof of class membership and gives (833) 890-4930 for questions.

My AT&T settlement claim was flagged as fraud. What now?

The opinion says 804,381 claims were declined for fraud. Under the cure process it describes, Kroll emails a Validation Form, which you print, sign in ink and mail in its own envelope, postmarked within 21 days of the email. Check any such email against the official site first.

Is there a new AT&T data breach in 2026?

AT&T’s EDGAR filing list shows no Item 1.05 cyber 8-K after July 12, 2024. Malwarebytes reported on February 3, 2026 that a dataset described as AT&T customer data was circulating, about 176 million records as described; the article carries no AT&T statement and no independent verification.

Methodology

References

1. AT&T Data Incident Settlement, official site, October 30, 2026 update. Accessed November 2026.
2. AT&T Data Incident Settlement, FAQ. Accessed November 2026.
3. In re AT&T Inc. Customer Data Security Breach Litigation, MDL 3:24-md-03114, Memorandum Opinion and Order, Document 534, October 2, 2026. Accessed November 2026.
4. Settlement Agreement and Finegan Second Supplemental Declaration, settlement Documents tab. Accessed November 2026.
5. AT&T Inc., Form 8-K, Item 1.05, July 12, 2024. Accessed November 2026.
6. SEC EDGAR, AT&T Inc. 8-K filing list. Accessed November 2026.
7. AT&T, Addresses Recent Data Set Released on the Dark Web, March 30, 2024. Accessed November 2026.
8. AT&T, Addresses Illegal Download of Customer Data, July 12, 2024. Accessed November 2026.
9. FCC Enforcement Bureau, AT&T Services Inc., Order and Consent Decree, DA 24-892. Accessed November 2026.
10. FCC, $13 million settlement news release, September 17, 2024. Accessed November 2026.
11. FCC Enforcement Bureau, AT&T Services, Inc., DA 15-399. Accessed November 2026.
12. FCC, Protecting Consumers from SIM Swap and Port-Out Fraud, FCC 23-95. Accessed November 2026.
13. Indiana Attorney General, 2024 data breach year-to-date report. Accessed November 2026.
14. Massachusetts OCABR, 2024 Data Breach Notification Report. Accessed November 2026.
15. Washington Attorney General, Data Breach Notifications (data.wa.gov). Accessed November 2026.
16. California Attorney General, Data Security Breach Reports. Accessed November 2026.
17. DOJ, W.D. Wash., United States v. Moucka and Binns, case page. Accessed November 2026.
18. Indictment, United States v. Moucka and Binns, 2:24-cr-00180-LK, October 10, 2024. Accessed November 2026.
19. DOJ, Moucka guilty plea release, August 5, 2026. Accessed November 2026.
20. DOJ, Wagenius sentencing release, September 25, 2026. Accessed November 2026.
21. DOJ, Wagenius guilty plea release. Accessed November 2026.
22. Federal Rules of Appellate Procedure, Rule 4 (Cornell LII). Accessed November 2026.
23. TechCrunch, FBI statement on the delay, July 12, 2024 (secondary, no primary copy found). Accessed November 2026.
24. TechCrunch, passcode reset, March 30, 2024 (secondary). Accessed November 2026.
25. TechCrunch, Maine filing, April 10, 2024 (secondary, Maine portal offline). Accessed November 2026.
26. LiveNOW from FOX, projected payout timing (cited as an example of a projection, not as a source of fact). Accessed November 2026.
27. Malwarebytes, February 3, 2026 (secondary). Accessed November 2026.