Class action lawsuit filed over recent AT&T data breach that exposed customer phone records

“The stolen logs include a record of virtually every number AT&T customers called or texted – including customers on other wireless networks – the number of interactions, and the length of calls. Records from customers in January 2023 may also be affected, as well as AT&T landline customers who interacted with those cell phone numbers,” Winger’s lawsuit states. “The aforementioned data is personally identifiable information (PII) and is valuable and sensitive.”

Winger, of Florida, says that having her personal information stolen puts her and other affected customers at increased risk of becoming victims of identity theft, fraud or even extortion.

She argues that AT&T did not adequately protect consumers’ data and did not warn them about the problem in a timely manner.

Law enforcement continues to investigate the theft of AT&T phone records and at least one arrest has already been made.

AT&T ShinyHunters data leak

This is the second major data breach at AT&T in recent months. The previously reported hack, carried out by an online group called ShinyHunters, resulted in personally identifiable information (PII) of more than 70 million customers being leaked on the dark web, including names, email addresses, social security numbers and other data.

A growing number of other data theft lawsuits have been filed against AT&T in connection with this incident, alleging that the company knew about the leaked data for years and failed to inform customers, putting them at increased risk of financial fraud. These lawsuits suggest that these hackers gained access to customers’ personal data as early as August 2021 and made customer information public on the dark web months ago.

However, AT&T’s first notification letters regarding the breach were only sent earlier this year, so the size and scope of the litigation is expected to increase dramatically in the coming months.

Given the increasing number of factual and legal issues raised in a growing number of complaints related to the data breach caused by ShinyHunters, the U.S. Judicial Panel on Multidistrict Litigation (JPML) last month established a multidistrict litigation (MDL) on the AT&T data breach, consolidating all complaints filed through the federal district courts in the U.S. District Court for the Northern District of Texas, under Judge Ada E. Brown, who is in charge of coordinated pretrial proceedings.

So far, the claims included in the MDL do not relate to lawsuits related to the recently disclosed AT&T data theft. It is unclear whether the class action lawsuit brought by Winger and other customers whose phone data was released will be centralized as part of the same MDL or whether a separate consolidated proceeding will be established.