The unauthorized electronic access took place over the weekend of Aug. 26-27 and was discovered within hours, a company spokesperson said. The store was shut down immediately and remains offline.
AT&T, based in San Antonio, also notified the major credit card companies whose customer accounts were involved.
The company is also working with law enforcement to investigate the incident and pursue the perpetrators, the spokesperson said.
About 19,000 customers are being notified by e-mail, phone calls and letters, the spokesperson said.
"We recognize that there is an active market for illegally obtained personal information. We are committed to both protecting our customers privacy and to weeding out and punishing the violators," said Priscilla Hill-Ardoin, chief privacy officer for AT&T.
"We deeply regret this incident and we intend to pay for credit monitoring services for customers whose accounts have been impacted. We will work closely with law enforcement to bring these data thieves to account."
Customers who have been affected have been provided with a toll-free number to call for more information, the spokesperson said.