I received the email.
From reading it closely, it sounds like ATT itself wasn't breached but a "3rd party partner". The email also mentions that my "Full Name, Date of Birth, Address, and SSN" were included.
So....ATT was sharing my SSN with a 3rd party? Thanks.
This is a classic example of the dangers of KYC that our stupid authorities insist on.