Interestingly, I stopped being an AT&T customer 4 years ago but just this morning I received a phishing SMS containing my real name and a mention of AT&T overpayment or some-such.
Could be a coincidence, or it could be the data is already out and being used.
Mine included a link. I already removed it so can't look at it now, but it definitely included one of those minified links that immediately scream "phishing".
Could be a coincidence, or it could be the data is already out and being used.