
Mobile communications company T-Mobile US, Inc. announced a $350 million agreement Friday to settle a consolidated class action lawsuit that claimed a criminal cyberattack last year left consumer information compromised.
According to a Securities Exchange Commission filing, the lawsuit – which was filed in Missouri – claimed that the “criminal cyberattack” involved unauthorized access to T-Mobile systems that left information of “current, former, and prospective customers,” vulnerable.
“On August 17th we confirmed that T-Mobile’s systems were subject to a criminal cyberattack that compromised data of millions of our customers, former customers, and prospective customers. Fortunately, the breach did not expose any customer financial information, credit card information, debit or other payment information but, like so many breaches before, some SSN, name, address, date of birth and driver’s license/ID information was compromised,” said a blog post from T-Mobile CEO Mike Sievert last year. “To say we are disappointed and frustrated that this happened is an understatement.”
Approximately 7.8 million “current T-Mobile postpaid customer accounts that included first and last names, date of birth, SSN, and driver’s license/ID information,” were compromised in the attack, said a T-Mobile announcement from last August. Another 5.3 million current postpaid customer accounts had some information compromised, as well as more than 40 million former customers and others.
The lawsuit against T-Mobile is currently pending in the U.S. District Court for the Western District of Missouri and the proposed settlement remains subject to preliminary and final court approval. If it is approved, T-Mobile would pay the $350 million to fund claims submitted by class members and also “commit to an aggregate incremental spend,” equal to $150 million for data security and related technology in this year and next year.
“The Company anticipates that, upon court approval, the settlement will provide a full release of all claims arising out of the cyberattack,” said T-Mobile. “The settlement contains no admission of liability, wrongdoing or responsibility by any of the defendants.”
According to the SEC filing, final court approval of the terms of the settlement could come as soon as this December. However, it could be delayed by appeals or other proceedings and the company has the right to terminate the agreement under certain conditions.
