Privacy & Information Security Law Blog

On July 22, 2022, T-Mobile entered into an agreement to settle a class action lawsuit stemming from its 2021 data breach. The breach involved the personal information of 76.6 million U.S. residents and was T-Mobile’s fifth breach over a four year period. The proposed settlement will require T-Mobile to pay $500 million to settle customers’ claims and to bolster its cybersecurity practices.  

The complaint alleged that T-Mobile “failed to properly protect personal information in accordance with their duties, had inadequate data security, was unjustly enriched by the use of personal data of the impacted individuals, violated certain state consumer statutes and other laws, and improperly or inadequately notified potentially impacted individuals.” T-Mobile denied these allegations and did not admit liability in the proposed settlement agreement.

Under the terms of the proposed settlement, T-Mobile would pay $350 million to a fund that will go to the class action claimants, claimants’ counsel and the costs of administering the settlement. In addition, T-Mobile must commit to spend $150 million above its budgeted baseline on “data security and related technology” for 2022 and 2023. T-Mobile indicated in its 8-K filing with the SEC that “final court approval of the terms of the settlement is expected as early as December 2022.”