If a company exposed your personal information in a data breach, you may be entitled to money from a class action settlement. Most data breach settlements offer some mix of cash payments, reimbursement for losses you can document, payment for time spent dealing with the breach, and free credit or identity monitoring. To collect, you usually have to file a claim on the official settlement website before the deadline.
Data breaches have become so common that many people ignore the notices. That is understandable, but it also means money goes unclaimed. Here is how to tell whether you are part of a settlement, what you might receive, and how to file without falling for the scams that follow big breaches.
How Data Breach Lawsuits Happen
When hackers steal customer data from a company, or a company accidentally exposes it, people affected often file lawsuits. They argue the company didn’t take reasonable steps to protect sensitive information like Social Security numbers, dates of birth, medical records, account numbers or passwords.
These lawsuits are usually combined into a class action on behalf of everyone affected. Rather than fight for years, many companies agree to settle. The settlement creates a fund, and people in the affected group can submit claims for a share.
Breaches at retailers, banks, phone carriers, health care providers, insurance companies, schools and software vendors have all led to settlements. Health care and financial breaches tend to involve the most sensitive data and sometimes larger settlements.
How to Know if You Are Included
You got a breach notice
Most states require companies to notify people when certain personal information is exposed. If you received a letter or email saying your data was involved in a security incident, keep it. It often lists the date of the breach and the type of information exposed, which helps you confirm you are in the class later.
You got a settlement notice
Once a settlement is reached, the court appointed administrator usually sends notices to people in the class. These often include a unique claim ID that makes filing quicker.
You were a customer during the breach period
Even if you never received a notice, you may be included if you were a customer, patient or account holder during the time covered by the settlement. The settlement website will list exactly who qualifies.
What Data Breach Settlements Typically Offer
Every settlement is different, but most include several types of benefits. You can often claim more than one.
| Benefit | What it covers | Proof usually needed |
|---|---|---|
| Cash payment | A flat or pro rata payment for being affected | Often none beyond confirming you are in the class |
| Out of pocket losses | Fraudulent charges not reimbursed, fees for credit freezes, costs of replacing ID, postage, professional help | Receipts, bank statements, documentation |
| Lost time | Hours spent dealing with the breach, often capped at a few hours at a set hourly rate | Usually a sworn statement describing what you did |
| Documented identity theft | Larger losses from actual fraud traced to the breach | Police reports, FTC identity theft reports, bank records |
| Credit or identity monitoring | Free monitoring service for a set number of years | Just an enrollment |
Some settlements also require the company to improve its security practices, though that doesn’t put money in your pocket directly.
How Much Money Will You Get?
For most people, the cash payment from a data breach settlement is modest. Many land between a few dollars and around a hundred dollars per person. Larger amounts are possible if you document real financial losses, which can sometimes be reimbursed up to several thousand dollars depending on the settlement’s limits.
The final amount for cash payments often depends on how many people file. If a fixed fund is divided among claimants, more claims mean smaller individual checks. Settlement websites often say the payment is an estimate for this reason.
That might not sound like much, but it is money that belongs to you, and documented losses are where filing really pays off. If you lost money to fraud or spent money freezing your credit, don’t skip the documentation section.
How to File a Data Breach Claim
- Find the official settlement website. Use the link in your notice or search for the company name plus “data breach settlement.” Make sure the site lists the court and case number.
- Read the class definition. Confirm you were affected during the dates listed.
- Check the deadline. Claims must be submitted before the cutoff.
- Gather documents. Your notice letter, any receipts for credit freezes or monitoring you paid for, bank statements showing fraud, and police or FTC identity theft reports.
- Fill out the form. Choose every benefit you qualify for and describe any time you spent dealing with the breach.
- Pick a payment method. Electronic options like PayPal or direct deposit are usually fastest.
- Save your confirmation. Keep the confirmation number and email.
Claiming Lost Time Correctly
Many settlements pay for time spent dealing with a breach. People often skip this because they didn’t keep records. You usually don’t need a timesheet, but you do need to describe what you did honestly. Time can include:
- Reviewing bank and credit card statements for suspicious activity
- Placing fraud alerts or credit freezes with the credit bureaus
- Changing passwords and security questions on accounts
- Calling banks or card companies about suspicious charges
- Filing reports with the police or the FTC
- Researching the breach and what to do about it
Only claim time you actually spent. Settlement forms are signed under penalty of perjury, and administrators review claims.
What if You Already Paid for Credit Monitoring?
Many people sign up for paid credit monitoring or identity protection right after a breach. If you paid for a service because of the breach, keep the receipts. Many settlements reimburse those costs as out of pocket losses, often up to a set limit. The same goes for fees to replace a driver’s license or passport if your ID numbers were exposed, notary fees, and certified mail costs for disputing fraud.
If you already have monitoring through your bank or another company, you can still usually enroll in the free monitoring offered by the settlement. Some people use both, since different services check different sources.
Protect Yourself After a Breach
Whether or not you file a claim, take these steps to limit damage:
- Freeze your credit with all three major credit bureaus. It is free by federal law and stops new accounts from being opened in your name.
- Check your credit reports, which you can get free from the official annual credit report website.
- Change passwords for the affected account and any account where you reused the same password.
- Turn on two factor authentication wherever possible.
- Watch your statements closely for small test charges, which often come before bigger fraud.
- Consider an IRS Identity Protection PIN if your Social Security number was exposed, to help prevent tax return fraud.
Watch Out for Breach Settlement Scams
Big breaches attract scammers. Fake emails and texts claiming to be from a settlement administrator are common. Be suspicious of any message that:
- Asks you to pay a fee to receive your payment
- Requests your full Social Security number, bank login or credit card number by email or text
- Pressures you to act within hours
- Uses a website address that doesn’t match the one in court documents
- Comes from a personal email account
Legitimate settlements never charge you to file. If in doubt, go to the settlement website directly by typing the address yourself rather than clicking a link.
Opting Out for a Bigger Claim
If you suffered serious, provable losses from identity theft, such as large fraudulent loans or significant damage to your credit that cost you money, the settlement’s caps might be lower than your real losses. In that case, you might consider opting out of the class and pursuing your own claim. This is a decision to make with a lawyer, because opting out means you get nothing from the settlement and must prove your own case. Opt out deadlines are usually listed on the settlement website.
Why Data Breach Cases Take Time
Settlement payments typically arrive after the court grants final approval and any appeals are resolved. That can take months or more than a year after the claim deadline. Large settlements with objections can take longer. The settlement website usually posts status updates, so check it there.
How to Keep Track of Breach Settlements
New data breach settlements open every month. A few habits make it easier to catch the ones that apply to you:
- Keep every breach notice you receive in one email folder or physical file
- Search your email periodically for “settlement” and “claim”
- Check reputable settlement listing websites from time to time
- Set a calendar reminder for any claim deadline you find
- Track claims you have filed, with confirmation numbers and expected payment dates
A Quick Example
Marcus receives a letter from a health insurer saying his name, birth date and Social Security number were exposed in a breach. He freezes his credit with the three bureaus, spends a couple of hours reviewing statements and changing passwords, and later notices a fraudulent $300 charge his bank refuses to reverse.
A year later, a settlement notice arrives. Marcus files a claim for the cash payment, his documented $300 loss with bank statements, and two hours of lost time. He also signs up for the free monitoring. Instead of a small flat payment, he receives reimbursement for his real loss plus the other benefits, because he kept his records.
Health Data Breaches Are Different
Breaches involving medical information can carry extra risks. Stolen medical data can be used for medical identity theft, where someone uses your insurance to get care or prescriptions. Watch your explanation of benefits statements from your health insurer for visits or services you didn’t receive. Report anything suspicious to your insurer right away. Health data settlements sometimes offer benefits specific to medical identity theft, so read the options carefully.
What to Do Next
Look through your email and mail for breach notices from the past few years. Search for the company name with “data breach settlement” to see if a claim is open. Freeze your credit if you haven’t already, and keep receipts for anything you spend protecting yourself. When a settlement opens, file promptly and include every benefit you qualify for.
Sources
- Federal Trade Commission: Identity Theft and Data Breaches
- FTC: Credit Freezes and Fraud Alerts
- AnnualCreditReport.com: Free Credit Reports
- IRS: Identity Protection PIN
This article is for general information only and is not legal advice. Laws change and every case is different, so speak with a licensed attorney in your state about your own situation.
Frequently Asked Questions
Will the company pay me directly?
No. Payments come from the settlement administrator appointed by the court, not the company itself.
Can I claim more than one data breach settlement?
Yes. If your data was exposed in several separate breaches, you can file a claim in each settlement you qualify for.
How do I know if I'm part of a data breach settlement?
Check for breach or settlement notices from the company. The official settlement website lists who qualifies based on dates and the type of data exposed.
How much do data breach settlements pay?
Cash payments are often small, from a few dollars to around a hundred. Documented losses can be reimbursed at higher amounts, up to the settlement’s limits.
Do I need proof to file a data breach claim?
Not for basic cash payments in many settlements. Reimbursement for losses usually requires receipts or statements.
Is it worth filing a data breach claim?
Usually yes. It is free, often quick, and you may qualify for monitoring and reimbursement in addition to cash.
Can I file if my identity hasn't been stolen?
Yes. Many settlements pay all class members a basic amount whether or not fraud occurred.
How do I avoid data breach settlement scams?
Never pay a fee, never share bank logins, and go directly to the official settlement website listed in court documents.
