In filing, the mobile phone company said the funds would pay for claims by class members, the legal fees of plaintiffs’ counsel and the costs of administering the settlement. The company said it would commit to an additional $150 million to bolster data security and related cyber technology in 2022 and 2023. 

“The Company anticipates that, upon court approval, the settlement will provide a full release of all claims arising out of the cyberattack by class members, who do not opt out, against all defendants, including the Company, its subsidiaries and affiliates, and its directors and officers,” the settlement reads. 

In a statement to Ars Technica, T-Mobile declined to provide information about upcoming plans to improve data security and instead linked to its statement, posted July 22, 2022, which claims the company has “doubled down” on efforts to guard against cyberattacks and enhance the cybersecurity of existing measures by creating a Cybersecurity Transformation Office that reports directly to [the] CEO and adding “top talent with decades of cyber strategy experience and leadership to [the] team,” for example. 

“T-Mobile T-Mobile has repeatedly been lax in applying minimally acceptable controls to prevent these violations of end user’s privacy and is now paying a fine the size of which should make other organizations take notice,” says Oliver Tavakoli, CTO at Vectra, a cybersecurity company. Tavakoli also notes that that “some of the data leaked was private information collected from individuals whose applications for phones T-Mobile rejected several years prior to the breaches — information which they had no rationale to even keep.”