The company said on Tuesday that "fewer than 19,000 customers" were affected the theft - which affected customers of AT&T's online retail store.
The telecoms giant said it had shut down the store and contacted credit card companies to warn them of the theft, which tool place at the weekend.
The company said the unauthorised access was found within hours of the breach.
A spokesman for AT&T, Walt Sharp, said no fraudulent credit charges had been reported so far.
Priscilla Hill-Ardoin, AT&T's chief privacy officer, said: "We recognise that there is an active market for illegally obtained personal information.
"We are committed to both protecting our customers' privacy and to weeding out and punishing the violators."
AT&T also said it would also pay for credit monitoring services to assist in protecting the customers involved.
The data theft involved people who had bought equipment for high-speed internet access.