Data Breach

A data breach happens when a company or organization loses control of personal information, whether through hacking, ransomware, a misconfigured database, a stolen laptop, or an insider. The exposed data can include names, addresses, dates of birth, Social Security numbers, driver's license numbers, bank and card numbers, passwords, and medical records.

Every state has a breach notification law requiring companies to tell affected people, and the FTC publishes guidance for businesses on responding. That notice letter is often how people first learn their information was exposed, and it frequently offers free credit monitoring.

Data breaches are one of the most common types of class action today. Plaintiffs usually allege the company was negligent in protecting data, broke promises in its privacy policy, or violated state consumer and privacy laws. Settlements typically offer several tiers: reimbursement of documented out-of-pocket losses up to a cap, payment for time spent dealing with the breach, credit monitoring, and sometimes a smaller flat cash payment for everyone in the class. Payouts depend on how many people file claims, so individual amounts are often modest unless you have documented losses.

If you get a breach notice, freeze your credit, change passwords, turn on two-factor login, and keep the notice and any receipts for losses. Our guides on what to do after a data breach notice and what a data breach settlement is worth go deeper, and the data breach lawsuit page tracks current cases.