Frontier Communications agreed to pay $625,000 to the Connecticut Attorney General’s office to resolve a 2024 data breach that affected 58,841 Connecticut residents. The settlement was announced Friday, October 16, more than two years after the breach was detected in April 2024. Verizon acquired Frontier in January 2026.
$625,000 Settlement Resolves Connecticut’s Frontier Breach Investigation
The Connecticut Attorney General’s office and Frontier reached the agreement to resolve the state’s review of the 2024 incident. The attacker used compromised credentials belonging to Frontier employees and vendors. Unencrypted personal data, including Social Security numbers, of 58,841 Connecticut residents was exfiltrated and later offered on the dark web.
The data was not only taken. It was later offered on the dark web, so the exposure extended past the intrusion itself to resale of the information. The 58,841 figure counts Connecticut residents only.
Attorney General William Tong said the settlement holds Frontier accountable. A Verizon spokesperson called it an amicable resolution.
Failings Identified in Frontier’s Security Program
Analysts identified shortcomings across several areas: identity and access management, segmentation, logging and monitoring, encryption, incident response, training and data loss prevention. The list covers the main stages of the attack, from credentials that could be abused, to data that was unencrypted, to the monitoring that should have caught the exfiltration.
The finding that the stolen data was unencrypted carries particular weight, since Social Security numbers were among the exposed information. Encryption would not have prevented the credential compromise, but it would have limited what the attacker could use.
Required Security Commitments: MFA, Penetration Testing and Detection
As part of the settlement, Frontier committed to a set of controls:
- Stronger access controls and password management.
- Multifactor authentication.
- Employee training.
- Penetration testing.
- Intrusion detection and endpoint detection.
These commitments map to the failings the state identified. Credential abuse is addressed by access controls, password management and MFA, while the monitoring gaps are addressed by intrusion and endpoint detection.
A Separate $5.64 Million Class-Action Settlement
Separately, Frontier reached a $5.64 million class-action settlement in federal court in Texas. It covers about 750,000 people, who receive two years of free credit monitoring. The two settlements address different groups: the Connecticut agreement resolves a state regulator’s claims for 58,841 residents, while the class action covers a far larger population.
What the Settlement Signals for Telecom and Other Regulated Companies
The state action arrives after a long lag. Breach detection in April 2024 and a settlement in October 2026 means the enforcement process ran for more than two years, and by then Frontier had changed ownership.
Credentials as the Recurring Entry Point
The Connecticut findings emphasize that employee and vendor credentials were the entry point. Companies that grant vendors access to internal systems face the same exposure, and the required commitments, MFA in particular, address that exposure. This settlement lists the security failings behind the breach in detail.
For other organizations holding sensitive customer data, the list of identified failures works as a checklist regulators may apply to them: access management, segmentation, logging, encryption, incident response, training and data loss prevention. The settlement amount is modest next to the class-action figure, but the required security program is the part that changes how Frontier operates.
Frontier’s commitments also give a benchmark for similar companies. Penetration testing and intrusion and endpoint detection test whether the new controls work, which separates them from policy-only commitments such as employee training. Whether Frontier, now part of Verizon, meets those commitments is something the Connecticut Attorney General’s office can check, and the class-action settlement in Texas separately gives about 750,000 affected people two years of free credit monitoring.
