I think that they realise that they can shift the burden of proof onto the accusers and call it a day. Unless the people behind the breach actually claim responsibility and allege it was AT&T that was breached, it's near impossible for anyone to prove them wrong.
The legal and PR teams just stick their heads in the sand. For example one could say "While there was unauthorized access there is no evidence that any personal information was taken." There's zero incentive to confirm the extent of PII leaks as it just triggers more liability and regulatory scrutiny.
