AT&T has suffered a major data breach affecting over 70 million users and it took two years to tell current and former customers about it "not originating from its systems". https://www.bleepingcomputer.com/news/security/att-says-leaked-data-of-70-million-people-is-not-from-its-systems/
More coverage here, which includes a HIBP tool to tell if you're been part of the breach: https://www.troyhunt.com/inside-the-massive-alleged-att-data-breach/