T-Mobile US has agreed to pay $350 million to compensate consumers hit by a cybersecurity breach of its internal records that one analyst called “the largest carrier breach on record.” The operator also said it will spend $150 million on data security over the next 18 months.

T-Mobile US noted the settlement in a filing with the Securities and Exchange Commission (SEC) late Friday afternoon. The filing explains that T-Mobile US entered into an agreement to settle a “consolidated class-action lawsuit” filed against the carrier “related to a 2021 criminal cyberattack involving unauthorized access to the company’s systems in which certain information about a number of the company’s current, former, and prospective customers was compromised.”

The class action is currently sitting in front of the U.S. District Court for the Western District of Missouri.

The cyberattack was initially reported by Vice nearly a year ago. It involved a breach of T-Mobile US servers that the carrier eventually admitted compromised personal information of at least 54 million customers.

That data included names, phone numbers, social security numbers, physical addresses, unique device identifier data, security PINs, and drivers license information, according to Vice, which viewed samples of the data and confirmed the information contains accurate information on T-Mobile customers.

Analysts initially were surprised by the scale of the attack.

“I believe this is the largest carrier breach on record,” Zeus Kerravala, principal analyst at ZK Research, wrote in response to questions at the time.

Stéphane Téral, chief analyst at LightCounting, agreed with that assessment, and both analysts noted that this marks T-Mobile’s sixth-known data breach in four years.

“T-Mobile has been a favorite target of hackers over the past few years, and they really need a complete rethink of security,” Kerravala said.

They also questioned T-Mobile US’ response.

“T-Mobile is not taking appropriate measures to secure their data, despite numerous breaches of increasing magnitude,” Forrester Research analyst Allie Mellen wrote in response to questions late last year. “While every business can and may be affected by a cyberattack, there is a continuous pattern here that indicates that T-Mobile does not seem to find it important to prioritize securing customer data.”

T-Mobile US management cited it had signed contracts with consulting firms Mandiant and KPMG to help mitigate the issue. It also offered to provide two years of free identity protection to any person who believes they may be impacted.

“Instead of addressing the security gaps that have plagued T-Mobile for years,” this gesture just ultimately pushes the responsibility for the safety of the data on to the user, Mellen said.

As part of its most recent SEC filing, the carrier also said it will spend an additional $150 million “for data security and related technology in 2022 and 2023.” The carrier did not provide details on where that investment might go, but could provide more details during its second-quarter earnings report later this week.