Or a lawsuit go through where someone can win quite a bit from from data leaks. If each person affected sued and won 100k or so, or even 1k, AT&T would definitely be spending money on security.
But it appears $5 or credit monitoring from an agency that also gets hacked is sufficient for class action lawsuits.