Some AT&T customers began receiving emails about a settlement in August 2025, prompting many to wonder whether the message were legit. Some social media users posted screenshots (archived) of the email they received from Kroll Settlement Administration. Others used their accounts on sites such as Instagram (archived) and TikTok (archived) to share (archived) news of the settlement with their followers. Several Snopes readers sent emails to ask us whether the settlement emails they received were real or were scams.
People receiving the emails could
The settlement was real, and the settlement's administrators sent legitimate emails to potential claimants in August 2025.
On June 20, 2025, a U.S. district court in Texas approved a settlement of a class-action lawsuit over a pair of AT&T data breaches, one from 2019 and another from 2024. The court's schedule of events set Aug. 4, 2025, as the date potential claimants should have started receiving notices.
The court approved the appointment of Kroll Settlement Administration as the settlement's administrator. Kroll sent out mail and email notices to potential claimants and created a website, telecomdatasettlement.com, for people to submit their claims.
According to Kroll's website, people who do nothing will not receive any benefits from the settlement. In order to be compensated, a claimant must submit or postmark a claim form no later than Nov. 18, 2025. Those wishing to opt out or object to the settlement have until Oct. 17, 2025, to do so.
The two data breaches were essentially treated as separate settlements with separate groups of claimants drawing from separate pots of money. Victims of the 2019 data breach were called AT&T 1 Settlement Class. Victims of the 2024 data breach were called AT&T 2 Settlement Class. Some people were affected by both breaches; Kroll called these people Overlap Settlement Class Members. Claimants from each settlement class could receive money in one of two ways:
- Documented loss cash payment: Claimants who receive a documented loss cash payment may receive up to $5,000 from AT&T 1 Settlement Class and up to $2,500 from AT&T 2 Settlement Class. Claimants who receive this kind of payment from both classes can therefore receive up to $7,500. To receive one or more documented loss cash payment, a claimant must submit documentation that they have suffered cash losses that are fairly traceable to the corresponding AT&T data breaches. The same documentation cannot be used to support both cash loss claims.
- Tier Cash Payment: Alternatively, those affected by the data breaches can claim tier cash payments, which is the usual class-action settlement payment determined based on the amount of money available to split to all claimants. There are three tiers of cash payment a claimant may receive this way. Tier 1 payments will go to victims of the first data breach whose Social Security numbers were included in the breach. These payments will be five times higher than the Tier 2 payments, which will go out to all other claimants for the first data breach. Tier 3 payments will go out to claimants of the second data breach.
Court documents showed the settlement for the first data breach was $149 million and the settlement for the second breach was $28 million
Kroll said it did not know the amount of money each tier cash payment claimant would receive at the time it sent out notices to potential claimants.