Attorneys at Almeida Law Group are investigating whether a class action lawsuit can be filed on behalf of individuals affected by a possible AT&T data breach. According to dark web monitoring sources, a hacker group calling itself EndZone claimed responsibility for a cyberattack on AT&T in a post first observed in September 2026, alleging it had gained access to internal company systems. As of this writing, AT&T has not issued a public confirmation of the incident, and the exact scope of any exposed data remains unknown. If you believe you were affected, contact Almeida Law Group.
About AT&T
AT&T Inc. is one of the largest telecommunications companies in the United States, headquartered at Whitacre Tower in Dallas, Texas, with plans to relocate to Plano, Texas by late 2028. The company provides wireless services, broadband internet, and enterprise networking. Its wireless business contributes nearly 70% of revenue and serves approximately 74 million postpaid and 17 million prepaid phone customers, while its residential broadband service reaches 15 million customers.
What Happened?
AT&T was named in a ransomware leak-site allegation reported by Ransomware.live on September 18th, 2026. The posting was attributed to a group calling itself EndZone, which Ransomware.live describes as an emerging group whose claims should be treated with caution until independently verified. The Ransomware.live entry was also flagged as a potential duplicate. No independent corroborating reporting from security researchers, news outlets, or AT&T itself has been found to verify this claim.
In its dark web post, EndZone claimed that initial access to AT&T’s systems was obtained through a CX contractor, and alleged that VPN and virtual desktop infrastructure were accessed for a prolonged period without detection. The group further claimed that certificates were exported from within a VDI environment and that Salesforce data was accessed through credentials tied to a project manager and a DirecTV contractor. These are entirely self-reported attacker claims and have not been confirmed by AT&T or any independent source. No specific data types or volume of records have been established. EndZone does not appear among the prominent ransomware groups tracked by major threat intelligence firms in 2026.
AT&T has a significant documented history of separate prior breach incidents. In January 2023, a third-party breach exposed data of approximately 8.9 million customers, resulting in a $13 million FCC settlement in September 2024. In March 2024, AT&T confirmed that personal information — including Social Security numbers — of approximately 73 million current and former customers had been compromised, with data believed stolen as early as 2019. In July 2024, AT&T disclosed that hackers accessed its Snowflake cloud environment between April 14th, 2024 and April 25th, 2024, stealing call and text metadata for nearly 110 million wireless customers; AT&T reportedly paid approximately $370,000 in Bitcoin ransom, and the incident was attributed to groups tracked as UNC5537, Scattered Spider, and ShinyHunters. In February 2026, a repackaged dataset of approximately 176 million AT&T records resurfaced on dark web forums with previously encrypted Social Security numbers now fully decrypted. AT&T agreed to a $177 million class action settlement covering claims related to both 2024 breach incidents, potentially covering up to 182 million people; as of mid-2026, final approval remains pending following a January 15th, 2026 hearing, and the claims deadline closed December 18th, 2025. None of these prior incidents are connected to the September 2026 EndZone allegation.
Key Facts at a Glance
- Company or Organization: AT&T
- Industry: Telecommunications
- Location: Dallas, Texas (headquartered at Whitacre Tower; planned move to Plano, Texas by late 2028)
- Incident type: Unverified ransomware leak-site allegation (EndZone group)
- Prior breach: Yes — multiple prior incidents including a January 2023 third-party breach ($13M FCC settlement), a March 2024 breach affecting ~73 million customers, a July 2024 Snowflake breach affecting ~110 million customers, and a February 2026 dark web resurfacing of ~176 million records
- Litigation status: $177 million class action settlement pending final approval as of mid-2026, covering up to 182 million people related to the 2024 breaches; no litigation identified for the September 2026 EndZone claim
- Source: Ransomware.live – AT&T EndZone claim; Security.org – AT&T Data Breach; Malwarebytes – AT&T breach data resurfaces; Open Class Actions – AT&T Settlement 2026
What Should You Do?
Because the scope of any data exposure in this incident has not been confirmed, AT&T customers should take precautionary steps regardless. Consider placing a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to limit the risk of new accounts being opened in your name. Review your credit reports for unfamiliar activity at AnnualCreditReport.com. Monitor your wireless account and any linked financial accounts for unauthorized changes or charges. If you believe your information may have been exposed in any of AT&T’s prior confirmed breaches, check whether you are eligible for identity theft protection through any settlement program, and report any suspected misuse of your information to the FTC at IdentityTheft.gov.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
