T-Mobile to pay $350 million in settlement over massive hacking
(Reuters) — T-Mobile US Inc. agreed Friday to pay $350 million to settle litigation over a cyberattack last year that compromised information belonging to an estimated 76.6 million people.
It also agreed to spend an additional $150 million to upgrade data security.
The preliminary settlement was filed with the federal court in Kansas City, Missouri.
It requires a judge's approval, which the second-largest U.S. wireless carrier said could come by December.
T-Mobile denied wrongdoing, including accusations that it breached its duties to protect customers' personal information and had inadequate data security.
The Bellevue, Washington-based company disclosed the data breach last August, saying at the time it affected more than 47 million current, former and prospective customers.
The number soon grew past 50 million, and T-Mobile said in November its investigation uncovered an additional 26 million people whose personal information was accessed.
T-Mobile has said the information included names, addresses, birth dates, driver's license data and Social Security numbers.
Friday's settlement covered nationwide litigation combining at least 44 proposed class-action lawsuits.
Class members may receive cash payments of $25, or $100 in California, and some could receive up to $25,000 to cover out-of-pocket losses, settlement papers show. They will also receive two years of identity theft protection.
John Binns, a 21-year-old American who had moved to Turkey a few years earlier, took responsibility for the hacking, saying he pierced T-Mobile defenses after finding an unprotected router on the internet, The Wall Street Journal said last August.
The plaintiffs lawyers may seek fees of up to 30%, or $105 million, from the settlement, the settlement papers show.
