In re AT&T Inc. Customer Data Security Breach Litigation

Background

This was a transfer order from the Panel on Multidistrict Litigation. A pro se plaintiff in the action identified on Schedule A as Williams v. AT&T Inc., C.A. No. 5:26-02458, moved under Panel Rule 7.1 to vacate an order that had conditionally transferred her action to the Northern District of Texas for inclusion in MDL No. 3114. AT&T Inc. opposed the motion and supported transfer.

The Panel had previously centralized cases involving the alleged AT&T data-security breach announced in March 2024. The opinion states that the compromised information allegedly came from a 2019 data set and included names, addresses, phone numbers, Social Security numbers, dates of birth, AT&T account numbers, and passcodes. The plaintiff’s action concerned the same breach and involved factual issues overlapping with the other MDL cases. The opinion also states that she had filed a substantially similar earlier action that remained in the MDL; that earlier related proceeding was identified as No. 24-01386 in the Northern District of Texas.

Plaintiff’s Arguments

The plaintiff argued that transfer was improper because she had opted out of the MDL class settlement, her individual action did not share enough factual questions with the class-based issues, transfer would be inconvenient and burdensome, and her pro se status weighed against transfer. She also argued that the MDL’s leadership structure and complex pretrial proceedings could exclude her from meaningful participation.

Panel’s Analysis

The Panel rejected these arguments. It explained that opt-out actions are routinely transferred to MDLs that include class settlements because the transferee court can manage overlapping actions efficiently and apply its expertise to common issues. Transfer would not require the plaintiff to join the settlement class or undo her decision to opt out. The Panel also noted that settlement approval proceedings were still pending and that substantial pretrial work could remain if final approval was not granted.

The Panel held that 28 U.S.C. § 1407 does not require the parties or factual issues in separate actions to be completely identical. Because the cases arose from the same alleged data breach, their pretrial proceedings would overlap even if some claims were individual rather than class claims. Individualized damages and discovery did not defeat transfer. The opinion identified increased identity-theft and fraud risks, mitigation efforts, and emotional distress as injuries that overlapped with injuries alleged in the MDL and the plaintiff’s earlier related action.

The Panel also considered the overall convenience of the parties and witnesses rather than the convenience of only one plaintiff or defendant. Because the transfer was for pretrial proceedings, it stated that the plaintiff likely would not need to travel to the Northern District of Texas. Finally, it concluded that being pro se did not prevent transfer and rejected the plaintiff’s concerns about meaningful participation as speculative.

Ruling

Acting Chair Matthew F. Kennelly signed the order for the Panel on Multidistrict Litigation. The Panel ordered that the Schedule A action be transferred to the Northern District of Texas and, with that court’s consent, assigned to Judge Ada E. Brown for coordinated or consolidated pretrial proceedings. Judges Karen K. Caldwell and David C. Norton did not participate.