AT&T Faces Class Action Over March Breach That Hit 73 Million

AT&T Inc. was sued for allegedly exposing approximately 73 million current and former users to privacy-related injuries as result of a recent data breach.

AT&T recklessly “maintained, used, and shared” customers’ personally identifiable information and “intentionally, willfully, recklessly, or negligently” failed to take measures to secure its system despite knowing it was in a condition that made consumers’ sensitive data vulnerable, according to the purported class action filed March 30 in the US District Court for the Northern District of Texas.

AT&T said in a statement that data from about 7.6 million current account holders and 65.4 million former account holder had been leaked in hacker forums. The statement didn’t reveal the cause of the breach.

Plaintiff Alex Petroski, an Ohio citizen, claims that because of AT&T’s negligence he and other breach victims will endure lifelong costs associated with their sensitive data being exposed online, including the cost of identity fraud-protection services. The complaint was brought in Dallas where AT&T is headquartered.

In addition to monetary damages, the complaint seeks an order requiring AT&T to cover out-of-pocket expenses related to identity theft-prevention and to implement new data-security measures such as full encryption and an outside audit.

The complaint also accuses AT&T of of failing to properly implement data safeguards suggested by the US Federal Trade Commission, including failing to minimize the time PII is stored and limiting access to sensitive data.

Petroski is represented by Kendall Law Group, PLLC, Milberg Coleman Bryson Phillips Grossman PLLC, and Hausfeld LLP. The defense hasn’t yet entered an appearance.

The case is Petroski v. AT&T Inc., N.D. Tex., No. 3:24-cv-00757, complaint filed 3/30/24.