Sloppy procedure by AT&T means that this breach means you can retrieve phone name and numbers, track their location, do man in the middle attacks and a number of other things.
And Harry, you won't mind posting your email on these forums then, in plain text? What, you say, there are consequences of spam? Right. I agree it should only be worth, alone, a free month's service. But the other consequences? Immediate SIM replacement with a properly-calculated IMSI and a minimum of SIX months free service, afaik.
If they don't
immediately replace the SIM's, I'd be filing a lawsuit if I was affected.