Class Actions
AT&T Customer Data Breach Litigation: MDL 3114 Status
What the AT&T customer data breach litigation shows: the federal MDL in Texas, the March 2024 incident, and what the court record leaves undecided.
On this page
Something in this article wrong, out of date, or missing its source? Send the editorial desk a note.
The AT&T customer data breach litigation is centralized in MDL No. 3114 in the Northern District of Texas. The Judicial Panel on Multidistrict Litigation created the proceeding by a transfer order dated June 5, 2024, which describes an alleged data security breach that AT&T announced in March 2024 and the release of personal information of over 70 million former and current customers on the dark web. The Panel’s October 1, 2026 statistics report lists 140 actions pending of 141 filed and names Senior Judge Sidney A. Fitzwater as the transferee judge. The documents reviewed for this article record no class certification, no approved settlement, no trial date and no ruling on liability.
What the transfer order says about the breach
The June 5, 2024 order states that the actions before the Panel were twelve putative class actions pending in the Northern District of Texas and the Western District of Oklahoma. It describes their common questions in one sentence: “These putative class actions present common factual questions concerning an alleged data security breach announced by AT&T in March 2024 concerning the personal information of over 70 million former and current AT&T customers released on the dark web.”
The order says the compromised information allegedly includes customer names, email addresses, mailing addresses, phone numbers, Social Security numbers, dates of birth, AT&T account numbers and passcodes. Those categories are the Panel’s summary of what the complaints assert. The order does not find that any particular record was taken and does not verify the customer figure.
It lists the common questions as how and when the breach occurred, AT&T’s data security practices, the investigation, “the alleged delay in disclosing the breach,” and the nature of the alleged damages. Both defendants, AT&T Inc. and AT&T Mobility LLC, supported centralization; the Panel chose the Northern District of Texas because AT&T is headquartered in Dallas and most related actions were pending there.
The order also records that the Panel had been notified of eighteen overlapping putative class actions in seven other districts, including the Northern, Eastern and Southern Districts of California and the Northern District of Georgia. It described those as potential tag-along actions, cases that could later be transferred into the proceeding.
What is established vs. what is alleged
Established by court records: the creation of MDL No. 3114 by the June 5, 2024 order; the transfer of the listed actions to the Northern District of Texas; the defendants named in the order; the eighteen overlapping actions the Panel had been notified of; and the pending count in the Panel’s October 1, 2026 report.
Alleged, not decided: that AT&T’s data security practices were inadequate; that the breach occurred in the manner the complaints describe; that AT&T delayed disclosure; that the data of more than 70 million people was released; and that class members suffered the damages claimed. The order repeats the complaints’ account and decides none of it. A transfer order settles where cases will be heard, not who is right.
Not recorded in the documents reviewed: an admission of liability by AT&T, a finding that a security failure caused the release, a certified class, an approved settlement, a trial date or a verdict.
Where the claims stand procedurally
MDL No. 3114 is a consolidated pretrial proceeding, not a class action in itself. The Panel transferred the listed cases to one judge for coordinated or consolidated pretrial proceedings. Individual lawsuits keep their identities, and the transferee court manages discovery, expert issues and pretrial motions for all of them. Our guide to how an MDL differs from a class action explains the distinction.
The transfer order assigned the proceeding to Judge Ada E. Brown. The Panel’s October 1, 2026 report, which lists active transferred dockets by actions pending, names Senior Judge Sidney A. Fitzwater for MDL No. 3114 and records 140 actions pending of 141 filed. The report is a statistical snapshot, not a ruling. The documents reviewed contain no order certifying a class, approving a settlement or setting a trial, and no customer notification date for the March 2024 incident.
A separate AT&T disclosure about call and text records
AT&T made a separate regulatory filing in July 2024 about a different data incident, and the two should not be merged. In a Form 8-K filed July 12, 2024, AT&T reported under Item 1.05 that on April 19, 2024 it learned that a threat actor claimed to have unlawfully accessed and copied AT&T call logs. AT&T said the actor accessed a workspace on a third-party cloud platform and exfiltrated files containing records of customer call and text interactions from approximately May 1 to October 31, 2022, and on January 2, 2023.
According to the filing, the data did not include the content of calls or texts, Social Security numbers, dates of birth or other personally identifiable information. The records covered nearly all of AT&T’s wireless customers and customers of mobile virtual network operators using its network, and AT&T said it would notify current and former affected customers. The filing also records that the Department of Justice determined on May 9, 2024 and again on June 5, 2024 that a delay in public disclosure was warranted.
That disclosure describes a different data set and period from the March 2024 release described in the transfer order. Nothing in the documents reviewed states whether claims about the call-record incident have been added to MDL No. 3114.
Key dates
- March 2024: AT&T announces the breach that the Panel’s transfer order describes.
- April 19, 2024: AT&T learns that a threat actor claimed to have accessed and copied call logs in a separate incident, per the Form 8-K. The exfiltration window it gives is April 14 to April 25, 2024.
- May 9 and June 5, 2024: the Department of Justice determines that a delay in public disclosure was warranted, per the Form 8-K.
- June 5, 2024: the Panel issues the transfer order creating MDL No. 3114 and assigns it to Judge Ada E. Brown in the Northern District of Texas.
- October 1, 2026: the Panel’s report lists 140 actions pending of 141 filed and names Senior Judge Sidney A. Fitzwater.
What this does not establish
The existence of MDL No. 3114 does not mean a court has found that AT&T’s security was inadequate or that it broke a law. It does not mean AT&T delayed notice; the complaints allege a delay, and the Panel’s order repeats that allegation without deciding it. The “over 70 million” figure likewise comes from the Panel’s description of the actions, not from a finding.
No settlement has been approved in the proceeding, and the documents reviewed record none. A website advertising an AT&T data breach payout should be treated cautiously; our guide to verifying settlement notices describes how to check an official court record. Related coverage of other consolidated data breach proceedings includes the Change Healthcare litigation and the MOVEit litigation.
Frequently asked questions
What is MDL No. 3114?
It is the federal multidistrict proceeding for lawsuits about the AT&T data breach announced in March 2024. The Panel created it by a transfer order dated June 5, 2024 and assigned the pretrial proceedings to the Northern District of Texas.
Is MDL No. 3114 a class action?
No. An MDL is an administrative consolidation of separate lawsuits for pretrial purposes. The transfer order describes the underlying actions as putative class actions, but no class has been certified in the documents reviewed for this article.
Has there been a settlement in the AT&T data breach litigation?
The documents reviewed for this article record no settlement, no preliminary approval and no final approval in MDL No. 3114. They also record no trial date.
How many actions are in the MDL?
The Panel’s October 1, 2026 report lists 140 actions pending of 141 filed. That count can change as cases are transferred, dismissed or remanded.
Sources
- United States Judicial Panel on Multidistrict Litigation: “Transfer Order, In re: AT&T Inc. Customer Data Security Breach Litigation, MDL No. 3114 (June 5, 2024)” (link, accessed 2026-10-24)
- United States Judicial Panel on Multidistrict Litigation: “MDL Statistics Report: Distribution of Pending MDL Dockets by Actions Pending (Oct. 1, 2026)” (link, accessed 2026-10-24)
- U.S. Securities and Exchange Commission: “Form 8-K, AT&T Inc. (filed July 12, 2024)” (link, accessed 2026-10-24)
Collective Claim publishes general legal information. This article is not legal advice and does not create an attorney–client relationship. Court records and agency actions change; verify current status with the court or agency before relying on it.