Unreported / Non-Citable
Background
This multidistrict litigation arose from two data-security incidents involving AT&T customer information. The first allegedly resulted from a 2019 compromise and involved information that could include names, contact information, dates of birth, account information, passcodes, and Social Security numbers. The second involved call-related data illegally downloaded from AT&T’s workspace on Snowflake’s cloud platform, including telephone numbers, interaction counts, aggregate call durations, and, for a small subset, cell-site identification numbers.
After mediation and confirmatory discovery, the parties entered a settlement establishing two non-reversionary cash funds: $149 million for the first incident and $28 million for the second. Eligible class members could seek documented-loss payments of up to $5,000 or $2,500, respectively, or elect tiered pro rata cash payments. The court considered the parties’ final-approval motion, objections, the settlement record, and the transcript of a January 2026 fairness hearing after the MDL was reassigned following the prior judge’s recusal.
The Court’s Holding
The court certified both settlement classes under Rule 23(b)(3) and granted final approval to the $177 million settlement, subject to a slight modification of the cy pres process. It found that the classes satisfied numerosity, commonality, typicality, adequacy, predominance, and superiority; that class members received constitutionally adequate notice; and that the settlement was fair, reasonable, and adequate. The court overruled the objections to approval.
The court approved attorneys’ fees of $49,666,666.66 for AT&T 1 class counsel and $9,333,333.33 for AT&T 2 class counsel, representing 33% of each fund, after applying the Johnson factors and conducting lodestar cross-checks. It also approved $1,060,051 in litigation expenses, $1,500 service awards for each of the 36 class representatives, and $18,856,175.48 in settlement-administration charges incurred to date, while reserving judgment on additional projected administration costs.
Key Takeaways
- The settlement creates two non-reversionary funds totaling $177 million for people affected by the separate AT&T data incidents.
- The court held that common questions about AT&T’s alleged duties and security practices predominated for settlement purposes despite individualized damages and variations in state law.
- The court approved a one-third fee award totaling approximately $59 million, finding that lodestar multipliers of 3.86 and 3.73 fell within the range accepted in common-fund cases.
Why It Matters
The decision illustrates how courts may certify nationwide data-breach classes for settlement even when individualized damages, arbitration issues, and variations among state laws could complicate litigation. It also underscores judicial scrutiny of settlement-administration expenses: because those charges reduce class recovery dollar for dollar, the court approved only the amount incurred to date and retained oversight of additional costs.