AT&T Lawsuit Claims 73 Million Customers’ Data Offered for Sale on Dark Web

Millions of AT&T customers found out last week that their personal information — including names, addresses and Social Security numbers — were stolen by cybercriminals and offered for sale on the dark web.

Now, one Ohio consumer whose data was exposed in the breach is taking action by filing a proposed class action against the telecommunications giant, demanding it make things right.

Plaintiff Alex Petroski filed the lawsuit against AT&T Inc. on March 30 in a Texas federal court, alleging the company was negligent in its protection of consumer data. 

The lawsuit was filed the same day the wireless carrier publicly announced that it had found a dataset on the “dark web” containing information including the Social Security numbers and passcodes of 73 million current and former account holders, the Associated Press reported.

The data breach puts customers at risk of harm, Petroski says, and is a direct result of AT&T’s failure to implement adequate cyber-security procedures to protect from a “preventable cyber-attack.”

Data offered for sale on the dark web

AT&T is one of the largest wireless carriers and internet providers in the country. This meant the company had access to masses of personally identifiable information and protected health information of current and former customers, the lawsuit says. 

In March 2024, the  details of 73 million former and current AT&T Customer accounts, including full names, email addresses, mailing addresses, phone numbers, dates of birth, social security numbers, AT&T account number and passcode were leaked online, the lawsuit states.

It says the details of the leaked data first appeared online in Aug. 2021, when an online user named “ShinyHunters” offered up the records for sale on a hacking forum for one million dollars. It says that the same data appears to have been made available for free by another actor, “MajorNelson,” in March. 

Personal data now in the hands of cybercriminals, lawsuit says

As of today, millions of AT&T consumers’ data remains in the hands of cyber-criminals who target personally identifiable information for its value to identity thieves, Petroski says.

He believes that his own data, released in the AT&T data breach, is already in the hands of cybercriminals who bought it on the dark web. The impact includes the risk of identity theft, loss of privacy and lost time trying to secure that online privacy.

Petroski says AT&T was storing and using customer information in a reckless manner, and in a “condition vulnerable to cyberattacks.” He’s looking to represent anyone in the United States whose information was accessed by an unauthorized party as a result of the AT&T data breach.

A history of major data breach class action settlements

AT&T is not the only company to suffer a major data breach. And those data breaches can lead to serious settlements. 

In 2017, Equifax, one of the largest credit reporting agencies, suffered a massive data breach that exposed the personal information of approximately 147 million people. Equifax agreed to pay up to $425 million to settle with the Federal Trade Commission, the Consumer Financial Protection Bureau and 50 U.S. states and territories. The settlement included funds for consumer restitution and credit monitoring services.

In 2013 and 2014, Yahoo experienced two significant data breaches that compromised the personal information of over 3 billion user accounts. In 2019, Yahoo agreed to a $117.5 million settlement to resolve a class action lawsuit related to these breaches.

The plaintiffs in the AT&T case are suing for negligence and breach of implied contract and are seeking certification of the class action, damages, fees, costs and a jury trial.

The plaintiff and proposed class are represented by Kendall Law Group PLLC, Milberg Coleman Bryson Phillips Grossman PLLC and Hausfeld LLP.

The AT&T data breach class action lawsuit is Petroski et al., v. AT&T Inc., Case No. 3:24-cv-00757-L in the U.S. District Court for the Northern District of Texas.