Hackers stole call and text records data from almost all 1.9 million AT&T Wireless customers.
The firm said Friday that one suspect had been arrested after the records - from May to October 2022 - were illegally downloaded and copied to a third-party platform this April.
The stolen data did not contain the content of calls or texts, but did record the numbers contacted, as well as the number and lengths of interactions.
The Justice Department said the delayed announcement of the hack was justified on national security grounds.
The company said in its filing to the securities and exchange commission it had secured its systems from further similar hacks and did not believe what was stolen was publicly available.
It said it first learned of the breach five days after hackers started stealing data on April 14.
They continued to do so until April 25.
The breach comes months after AT&T disclosed that data from 2019 of 73 million former and current customers had been stolen and placed on the dark web by fraudsters.