How much is a data breach settlement worth?

Nearly every breach settlement uses some combination of four benefits. You can often claim more than one.

1. Flat or pro rata cash. A payment anyone in the class can claim without receipts. It is either a set amount or an equal share of what is left in the fund after other claims are paid, so the final number is not known until claims close.
2. Documented out-of-pocket losses. Reimbursement for money you spent or lost that is fairly traceable to the breach: fraudulent charges that were not reimbursed, credit freeze fees, postage, professional fees for fixing identity theft, and similar costs. This tier requires proof.
3. Lost time. Payment for hours spent dealing with the breach, usually a few hours at a fixed rate. Some settlements let you self-certify a small number of hours.
4. Credit monitoring and identity restoration. Free monitoring for a set period, and sometimes restoration services available to every class member whether or not they file.

Out-of-pocket reimbursement caps in major breach settlements have ranged from $5,000 per person to $25,000 per person. Hitting the cap requires real, documented losses, which most class members do not have.

These figures come from the official settlement websites. They show what was offered, which is not always what people received after pro rata adjustments.

Equifax's $380.5 million consumer fund offered up to $125 in alternative cash, but its website warned the amount "may be substantially less than $125" depending on the number of claims. Its website now says that because money remained in the fund, the caps on time-spent and alternative payments were lifted and valid claimants became eligible for additional pro rata payments.

T-Mobile paid $350 million into its fund. Its official FAQ offered a $25 alternative cash payment, or $100 for people living in California on August 1, 2021, and up to $25,000 for documented losses, with payments that "may be reduced or increased depending on the total number and amount of claims."

Smaller breaches produce smaller funds. The ABC Legal data breach settlement is a $2.5 million fund, and the Globe Life data breach settlement is $3.4 million. You can compare other breach settlements such as Panda Express and Labcorp on our open settlements list.

Four factors drive most of the difference.

• What data was exposed. Stolen Social Security numbers, bank account numbers, or medical records create more risk of fraud and more documented losses than exposed email addresses or phone numbers, which gives the class more leverage in negotiations.
• Fund size per class member. A $3 million fund split across a few hundred thousand people behaves very differently from a $350 million fund split across tens of millions.
• Claims rate. In pro rata settlements, fewer claims mean bigger checks. The FTC's 2019 study of 149 consumer settlements found a median claims rate of 9%, so in many settlements more than 90% of eligible people never file.
• State law. Residents of states with breach statutes that provide statutory damages often get a separate, higher tier.

California is the most common example. Under California Civil Code 1798.150, a consumer whose nonencrypted personal information is stolen because a business failed to maintain reasonable security can recover $100 to $750 per incident, or actual damages if greater. That is why T-Mobile offered California residents $100 instead of $25.

Deductions matter too. Attorneys' fees, administration costs, and service awards come out of the fund before cash payments are calculated. The ABC Legal notice, for example, says class counsel will ask for up to one-third of the $2.5 million fund plus costs. See who pays the lawyers in a class action.

Headline figures describe the whole fund or the maximum possible benefit. Your payment is usually far smaller for three reasons: fees and costs are deducted first, documented-loss claims are paid before flat cash in many agreements, and pro rata cash shrinks when more people file than expected.

The reverse also happens. When fewer people file than expected, pro rata cash can grow. The ABC Legal settlement estimates its no-document payment at $50 but says it may be increased or decreased based on the number of approved claims, up to $450. And leftover money from uncashed checks can fund a later residual payment. See why class action payouts are smaller than expected and what happens to unclaimed settlement money.

People sometimes ask why breach settlements pay so little when the company plainly failed to protect their data. Part of the answer is that the class would face real risk at trial, and the settlement price reflects that risk.

The biggest hurdle is proving harm. In TransUnion LLC v. Ramirez (2021), the Supreme Court held that only plaintiffs who were concretely harmed have standing to seek damages in federal court, and that the risk of future harm, on its own, is not enough to support a damages claim. For breach victims, that means someone whose data was exposed but never misused may have trouble recovering damages, while someone who suffered actual fraud, paid for credit freezes, or lost time fixing accounts is on firmer ground. Companies also argue that a particular fraud came from some other breach, since the same data is often stolen more than once.

This is why settlements separate the no-proof tier from the documented tier. The no-proof payment reflects the weak position of people with no provable loss, and the documented tier lets people with real losses recover more without filing their own case.

If you do have serious, documented losses, you have a choice. You can file a documented claim in the class settlement, subject to its cap, or you can opt out and pursue an individual claim, which is slower and riskier but not limited by the settlement's caps. Opting out must be done by the deadline in the notice, and your own claim is still subject to the statute of limitations.

1. Confirm you are in the class. Your breach notice letter or email usually includes a notice ID. The class is defined by the specific incident and date range, not by being a customer in general.
2. Claim every tier you qualify for. Most settlements let you combine documented losses, lost time, and monitoring. Check the claim form carefully.
3. Gather documents for real losses. Bank statements showing unreimbursed fraud, receipts for credit freezes or identity theft services bought after the breach, and notes on time spent (dates and what you did).
4. Only claim what is true. Claim forms are signed under penalty of perjury, and administrators audit documented claims.
5. File on the official settlement website before the deadline, and pick electronic payment if offered, which is often faster.

If you just received a breach letter and no settlement exists yet, start with what to do after a data breach notice and our overview of data breach lawsuits. If your losses are large, for example thousands of dollars in fraud that was not reimbursed, a class payment may not cover them, and a free case review takes about two minutes. Anyone who wants to keep an individual claim must opt out before the deadline in the notice.