It doesnâ€™t sound as if anyone suffered any damage as a result of this. Quite the contrary, they identified a problem that could have caused harm to many users had it not been fixed.
It would seem that AT&T's problem is not with the individuals identifying a problem, but with their disclosing it to a journalist who proceeded to publish their findings. I guess they would have preferred that the problem be quietly reported to them without the public being made aware of their incompetence.
Generally speaking, our system of law requires a defendant to compensate an aggrieved party for damages suffered as a result of the defendantâ€™s action. I don't really see where AT&T suffered any damages, aside from damage to its reputation (totally justified IMHO), and hopefully, the judge/jury in this case will agree.