T-Mobile’s 2021 data breach settlement resolved a consolidated class action for $350 million, covering roughly 76.6 million U.S. residents whose personal information was exposed. The court granted final approval on June 29, 2023, payments to claimants were distributed by the end of May 2025, and anyone with a valid claim who never received their money has until March 31, 2026, to request a reissue.
Who Was Covered
The settlement class included current, former, and prospective T-Mobile customers whose data was accessed in the August 2021 intrusion. The stolen information varied by group. About 40 million former or prospective customers had names, addresses, dates of birth, Social Security numbers, and driver’s license information taken. Roughly 7.8 million current postpaid customers had the same categories exposed. Another 5.3 million current accounts had personal details accessed but not necessarily Social Security or ID numbers, 850,000 prepaid customers had names, phone numbers, and account PINs compromised, and up to 52,000 Metro by T-Mobile account holders were also potentially affected.1T-Mobile Newsroom. Additional Information Regarding 2021 Cyberattack Investigation T-Mobile said financial data such as credit card or bank account numbers was not among the stolen files.
The consolidated case, In re: T-Mobile Customer Data Security Breach Litigation, MDL No. 3019, proceeded in the U.S. District Court for the Western District of Missouri before Judge Brian C. Wimes.2T-Mobile Settlement. T-Mobile Data Breach Settlement FAQs
What Class Members Could Claim
The $350 million common fund supported three main options. T-Mobile also committed, separately, to spending $150 million on cybersecurity improvements over two years.3Keller Rohrback. T-Mobile 2021 Data Breach
- Reimbursement of up to $25,000 for documented out-of-pocket losses traceable to the breach, including credit monitoring, credit freezes, and professional fees. Lost time was paid at $25 per hour, up to 15 hours with documentation or up to 5 self-certified hours.
- A flat alternative cash payment of $25 for class members who did not claim specific losses, or $100 for those who resided in California as of August 1, 2021.
- Two years of identity defense services through Pango, plus restoration services available to all class members.
The higher California payment reflected statutory damages under the California Consumer Privacy Act, which allows $100 to $750 per consumer per violation when a company fails to maintain reasonable security practices.4California Lawyers Association. T-Mobile’s Breach Highlights the Importance of Data Minimization and CPRA All cash amounts were subject to pro rata adjustment based on the total number of claims received.2T-Mobile Settlement. T-Mobile Data Breach Settlement FAQs
The claims deadline was January 23, 2023. About two million people filed claims out of the 76.6 million eligible, and only thirteen objections were submitted.5FindLaw. In re T-Mobile Customer Data Security Breach Litigation Kroll Settlement Administration processed the claims.
If you did not file by the January 2023 deadline, the settlement is closed to new claims. Nothing in the record indicates a late-claim procedure.
If You Filed a Claim but Never Got Paid
Distribution of settlement funds began in May 2025, and by May 30, 2025, all court proceedings and payment runs were complete.6T-Mobile Settlement. T-Mobile Data Breach Settlement Payments went out through PayPal, Zelle, Venmo, ACH, or paper check, depending on what claimants selected.
Some electronic payments failed. In November 2025, the settlement administrator emailed affected claimants asking for updated payment information. If you filed a valid claim and never received your money, you have until March 31, 2026, to contact the administrator at 1-833-512-2314 and request a reissue.6T-Mobile Settlement. T-Mobile Data Breach Settlement After that date, the file gives no procedure for recovering unclaimed funds.
The Fee Fight That Delayed Payments
Payments took nearly two years after final approval largely because of a dispute over attorney compensation. Judge Wimes initially awarded class counsel $78.75 million, or 22.5% of the fund. Two objectors appealed.
On July 29, 2024, the Eighth Circuit affirmed the underlying settlement but reversed the fee award as an abuse of discretion, calling it a “windfall.” Class counsel had logged about 8,000 hours, with 3,000 more anticipated, producing a lodestar near $8.17 million. The original award represented a 9.6 multiplier, effectively $7,000 to $9,500 per hour in a case that settled within months, involved minimal discovery, and required no substantial motion practice.5FindLaw. In re T-Mobile Customer Data Security Breach Litigation
On remand, counsel submitted a reduced request of $46 million, or 13.08% of the fund.7Reuters. T-Mobile Class Action Plaintiffs Slash Legal Fee Bid to $46 Million The district court granted that motion on January 16, 2025, the appeal window closed without further challenges, and distribution began soon after.3Keller Rohrback. T-Mobile 2021 Data Breach
The Separate FCC Penalty
The $350 million class settlement is not the only money T-Mobile paid over the 2021 breach, and none of the FCC money goes to consumers. On September 30, 2024, the FCC announced a consent decree resolving investigations into the 2021 incident and two later breaches. T-Mobile agreed to pay a $15.75 million civil penalty to the U.S. Treasury and spend an additional $15.75 million on cybersecurity improvements.8FCC. T-Mobile Consent Decree
The consent decree also required T-Mobile to adopt zero-trust network architecture, deploy phishing-resistant multi-factor authentication, commission independent security assessments, establish data minimization and disposal processes, and have the Chief Information Security Officer report regularly to the board on cybersecurity risks.9FCC. T-Mobile Required to Change Business Practices After Data Breaches
Ongoing Risk from the Stolen Data
A large portion of the stolen records surfaced for sale on the dark web soon after the breach, raising the risk of identity theft for people whose Social Security numbers and driver’s license information were exposed.10North Carolina Department of Justice. Consumer Alert: Take Action if You Were Impacted by the 2021 T-Mobile Data Breach The identity defense services offered through the settlement lasted two years; that coverage window has now closed for most claimants, but the underlying data does not expire.
One documented downstream harm was SIM-swap fraud, in which criminals use stolen personal details to hijack a victim’s phone number, intercept two-factor authentication codes, and drain financial accounts. Reported cases included a T-Mobile customer who lost $60,000 from a Citibank account through a fraudulent wire transfer during a SIM swap, later refunded by the bank, and a nurse who had $20,000 wired out of her account and was initially denied reimbursement, prompting her to sue both T-Mobile and Citibank.11ABC7 New York. SIM Card Phone Scam Bank Multiple law firms have reported representing SIM-swap victims in arbitration and separate litigation outside the class settlement.12Consumer Protection. SIM Swap Attacks Target Millions If you suffered a specific financial loss tied to the breach that was not covered by your class claim, that separate track may still be available depending on your carrier agreement and state law.