McCollum v. AT&T Services Inc et al

On August 2, 2024, plaintiff Christopher McCollum filed a class action lawsuit in the U.S. District Court for the Northern District of Texas against AT&T Services Inc. and AT&T Inc. The suit arises from a massive data breach disclosed in July 2024, where hackers illegally downloaded call and text records of nearly all AT&T wireless customers from a third-party cloud platform. The plaintiff alleges that AT&T failed to implement adequate security safeguards, negligently retained sensitive data, and delayed notifying affected individuals. The complaint asserts claims for negligence, breach of implied contract, invasion of privacy, and violations of various state consumer protection and data breach notification laws, seeking monetary damages and injunctive relief on behalf of a nationwide class.

The case remains pending; no final judgment or settlement has been reached as of the current procedural stage.

Whether AT&T failed to exercise reasonable care in protecting customer call detail records, whether its delayed breach notification violated statutory duties, and whether the company's data retention practices breached implied contractual obligations and consumer privacy expectations.

The lawsuit intensified public scrutiny over telecommunications data security and underscored the widespread risks of third-party cloud vulnerabilities. It amplified calls for stricter federal data privacy legislation and prompted renewed debate over mandatory data minimization and prompt breach notification requirements within the industry.