I think what AT&T is saying is that it wasn't taken from AT&T servers. Rather, AT&T gave the data to some third-party data-processor (i.e. to some ad company), and that company then lost it.
... Honestly, that shouldn't really make us feel any better about them though, like why would AT&T give out data that includes SSNs to third-party data-processors.
I'm pretty sure I have several lifetimes' worth of free credit monitoring with all the breachleaks happening all the damn time, if I could be arsed to redeem them.
... Honestly, that shouldn't really make us feel any better about them though, like why would AT&T give out data that includes SSNs to third-party data-processors.