It seems to that the real villain is AT&T, for making this private data entrusted to its care freely available to the public. What criminal and civil liabilities will it face?
That's disingenuous. "Freely available" implies that AT&T desired to give this data away or advertised it knowingly. Clearly they didn't. What Auernheimer did, with intent, was to bypass AT&T's intended use of the system. What AT&T did was incompetent or perhaps even negligent by a reasonable notion of corporate coding standards. You'd need to dig a bit more to learn how systemic the incompetence/negligence was befor…
ATT said in court that this data was published (by ATT).