Lawsuit Claims AT&T Failed to Prevent Data Breach, Exposing Customers to Cyber Crimes and Fraudulent Financial Activity

Another class action lawsuit has been filed over a massive AT&T data breach announced earlier this year, which led to the personal data of more than 70 million customers being released on the Dark Web, exposing them to a risk of identity theft and fraud.

The complaint (PDF) was brought by Fulvia Banu on June 18 in the U.S. District Court for the Southern District of Florida, alleging that AT&T failed to adequately secure customers’ personal identifying information (PII), resulting in a slew of cyber crimes, including opening new financial accounts in customers’ names, taking out loans, obtaining government benefits, filing fraudulent tax returns and other activities.

Banu joins a growing list of consumers who have filed AT&T data breach lawsuits in recent months, seeking financial damages since the company became aware of the data breach in 2021, but did not alert customers to the problem until earlier this year. The breach affected about 7.6 million current AT&T account holders, as well as 65.4 million previous customers.

The litigation emerged after information about the AT&T data breach was confirmed on March 30, indicating that customers’ names, addresses, phone numbers, Social Security numbers, and email addresses were exposed. However, the admission came only after hackers publicly posted the data on the Dark Web.

Banu, from Florida, indicates that AT&T failed to put the proper safeguards in place that would have prevented a group of hackers, known as ShinyHunters, from accessing that data and selling the personal information for profit. Then the company doubled down on its earlier mistake by not telling consumers they were at risk of identity fraud for up to three years.

According to her complaint, Banu was not notified until April 25 that her data was included in the breach, and then discovered an unauthorized person had opened a bank account in her name, which she had to spend time to investigate and try to have shut down.

The lawsuit seeks class action status for all residents in the U.S. whose personal information was made available through the data breach.

“By using the Personally Identifiable Information accessed in the Data Breach, data thieves have already engaged in identity theft and fraud by selling the data on the dark web,” Banu states in the complaint. “In the future criminals may, and probably will, commit a variety of crimes including, e.g., opening new financial accounts in Class Members’ names, taking out loans in Class Members’ names, using Class Members’ information to obtain government benefits, filing fraudulent tax returns using Class Members’ information, obtaining driver’s licenses in Class Members’ names but with another person’s photograph, and giving false information to police during an arrest.”

June 2024 AT&T Data Breach Lawsuit Update

Given common questions of fact and law raised in complaints filed throughout the federal court system, the U.S. Judicial Panel on Multidistrict Litigation (JPML) established consolidate pretrial proceedings for the cases as part of an AT&T data breach lawsuit MDL (Multidistrict Litigation) earlier this month, centralizing the claims in the U.S. District Court for the Northern District of Texas under Judge Ada E. Brown.

As part of the coordinated management of the litigation, it is expected that Judge Brown will establish a coordinated schedule for discovery to uncover how the customer information was released, steps that could have been taken to prevent the breach and how long AT&T knew about the problem.

If the parties fail to negotiate AT&T data breach lawsuit payouts for individual customers, it is likely that the Court will select a small group of representative cases to serve as early “bellwether” trials, which typically help the parties gauge how juries may respond to certain evidence and testimony that is likely to be repeated throughout the litigation.