AT&T security fail
I have some sympathy with him suing AT&T - their incompetence in not properly verifying his identity before making such a big change as porting his number is pretty clear.
Though, I wouldn't ever advise securing $million assets with nothing but an SMS for 2FA.