T-Mobile has agreed to pay $500 million to settle a class-action lawsuit arising from the 2021 hack that it says exposed approximately 76.6 million US residents. Under the proposed agreement, completed Friday, which you can read in full below, T-Mobile will put $350 million into a settlement fund to go toward attorneys, fees and, of course, those making claims. It will also be required to spend $150 million on “data security and related technology” in 2022 and 2023, in addition to what it had already budgeted for.
In August, the company announced that its systems had been hacked after reports that the social security numbers, names, addresses and driver’s license details of more than 100 million of its customers were for sale. While the number turned out to be slightly too high, the number of people affected by T-Mobile continued to climb for the rest of the month. The T-Mobile CEO called this security breach — the fifth in four years — “humiliating.”
The proposed settlement agreement has yet to be approved by a judge, but if it does, T-Mobile will have 10 days to put money into the fund to cover the cost of notifying people who qualify for a claim. According to the settlement, this covers “the approximately 76.6 million U.S. residents identified by T-Mobile whose information was compromised during the data breach,” with a few caveats for some carrier employees and people close to the judges who presided over the case stand. In the interest of vol revelationthat could very well mean I’m eligible for compensation, since I was a T-Mobile customer when the hack happened.
The settlement agreement does not include estimates of how much each claimant can expect to receive, although it’s difficult to estimate that sort of thing until it’s clear how many people will file claims.
The lawsuit that T-Mobile hopes to settle here accused the company of failing to protect its past, current and potential customers’ data, not properly informing people who may be affected, and generally “inadequate data security.” to have. T-Mobile denies these allegations in the agreement and states that the settlement does not involve an admission of guilt. In filing with the Securities and Exchange Commissionthe carrier says it has “the right to terminate the contract subject to certain conditions” as stipulated in the proposed agreement, but says it expects to have to pay the claims.
Outside of this lawsuit, there have been other responses to T-Mobile’s data breach and other similar responses. The FCC proposed new rules around such attacks, which aim to improve the way a company communicates with people about their data.