Chime Data Breach Lawsuit 2026: What Happened and Who May Qualify

Chime is a financial technology company based in San Francisco that offers checking, savings, and credit-building accounts through partner banks. On April 1, 2026, Chime customers reported they could not get into the app or see their balances. Chime acknowledged a service disruption and told customers that "the money in your account and your personal information are secure."

Around the same time, a group called Team 313, also known as 313 Team and the Islamic Cyber Resistance in Iraq, claimed online that it had crashed Chime's servers and disabled the app and website. News reports describe the group as Iran-linked. The lawsuits go further and allege that the group breached Chime's systems and stole personal information such as Social Security numbers, mailing and email addresses, phone numbers, and account credentials.

Chime disputes that account. A Chime spokesperson told Banking Dive that the company "identified and quickly resolved a brief disruption affecting only our marketing website" with "no impact to member information," and that "a separate, unrelated internal issue temporarily affected our app." Chime's position is that in both April 2026 incidents "no funds or member data were compromised."

That gap matters. In most data breach cases, the company has confirmed the breach and mailed notices, and the fight is over responsibility and damages. Here, the first question is whether a breach of personal data happened at all.

Three proposed class actions were filed in the U.S. District Court for the Northern District of California:

Case	Case number	Filed
Castaneda v. Chime Financial, Inc.	3:26-cv-02924	April 3, 2026
Porter v. Chime Financial, Inc.	3:26-cv-02998	April 7, 2026
Walsh v. Chime Financial, Inc.	3:26-cv-03278	April 17, 2026

The Castaneda complaint, brought by customers in Madera, California and Chicago, focuses on harm from the outage itself, such as anxiety and a late rent payment when the plaintiffs could not see their accounts. The Porter complaint alleges Chime failed to use reasonable security, including multifactor authentication and encryption. The Walsh complaint alleges customers now face "an imminent and ongoing risk of harm, including identity theft and fraud." According to Banking Dive, none of the complaints describes a specific misuse of a plaintiff's personal information.

As of September 2026, no court has ruled on the merits, no class has been certified, and no settlement has been announced in the Chime breach cases. Chime has said it believes the claims are without merit. The allegations are unproven.

What happens next

The usual next step in a case like this is a motion to dismiss. Chime is likely to argue that no personal data was taken and that the plaintiffs cannot show a concrete injury. Federal courts take that second point seriously: in TransUnion LLC v. Ramirez (2021), the Supreme Court held that only people who suffered a concrete harm have standing to sue for damages in federal court. Outage-related costs, such as a late fee, are more concrete than a general fear of future identity theft, which is why the Castaneda plaintiffs focused on them. If the cases survive, the parties would move into discovery, where evidence about what the attackers actually accessed would come out.

Federal dockets also show dozens of other 2026 suits against Chime Financial in courts around the country, many filed by individual customers. Those are separate from the data breach class actions, and many involve account access or closures rather than data security.

If the cases proceed, the court will define the class. Based on the complaints, the people most likely to be covered are:

• Chime customers whose personal information was held by Chime at the time of the alleged April 2026 attack.
• Customers who lost access to their accounts during the April 1, 2026 disruption and suffered a concrete cost, such as a late fee or missed payment.
• Anyone who later receives a formal breach notice from Chime, if one is ever sent.

You probably do not have much of a claim if you were a Chime customer but had no trouble accessing your account, never received a notice, and have seen no fraud. Courts often dismiss data breach claims where plaintiffs cannot show a concrete injury, and that risk is higher when the company denies data was taken. Our guide on how to know if you qualify walks through the usual tests.

If your money was frozen or your Chime account was closed and you are fighting to get funds back, that is a different kind of claim. See our pages on bank fee lawsuits and the FCRA explainer for related rights.

There is no Chime breach settlement, and no amount has been proposed. What the law allows depends on which claims survive:

• California Consumer Privacy Act. Cal. Civ. Code § 1798.150 allows California residents statutory damages of $100 to $750 per consumer per incident, or actual damages if greater, but only when certain nonencrypted personal information is stolen because of unreasonable security. If no data was taken, this claim fails.
• Negligence. Requires actual harm, such as out-of-pocket losses, fraud, or in some courts lost time.
• California Unfair Competition Law. Allows restitution and injunctive relief rather than damages.

For context, the Chime-related money actually paid out so far came from a regulator, not a class action. On May 7, 2024, the CFPB ordered Chime to pay at least $1.3 million in redress and a $3.25 million civil penalty for failing to refund balances within 14 days after accounts were closed. That order is unrelated to the 2026 cyberattack claims.

Typical data breach settlements pay for documented losses, lost time, and credit monitoring, with small flat payments for everyone else. See how much a data breach settlement is worth for real figures from past cases. Nothing here means you will receive money.

The complaints plead a familiar set of data breach claims:

1. Negligence and negligence per se: Chime allegedly owed customers a duty to protect their data with reasonable security and breached it.
2. Breach of implied contract: customers allegedly gave their data on the understanding it would be protected.
3. California Consumer Privacy Act: a private right of action for breaches caused by unreasonable security, with the statutory damages described above.
4. California Unfair Competition Law, Bus. & Prof. Code § 17200: unlawful or unfair business practices.

Chime operates as a technology company that partners with banks, and the CFPB has described Chime as responsible for nearly all customer communications and account servicing policies. That means federal banking rules on account access, like the Electronic Fund Transfer Act, can come into play for people who could not get to their money, separate from the breach theory.

Many consumer financial accounts include an arbitration clause and a class action waiver. If Chime's agreement is enforced that way, it could push some claims into individual arbitration. Read the version of the agreement you accepted.

Because Chime denies a breach, there is no official list of affected customers. You can still check for warning signs:

• Look for a formal notice. State breach laws require companies to notify people when certain personal information is acquired by an unauthorized person. California law also requires a company to send a sample notice to the state Attorney General when a breach affects more than 500 California residents, and those notices are posted publicly, as are filings with the Maine Attorney General. If Chime ever files one, it will show up there.
• Pull your credit reports from all three bureaus through the free annual credit report program and look for accounts or inquiries you do not recognize.
• Review your Chime transaction history back to April 1, 2026 for transfers or card charges you did not make.
• Watch for targeted phishing that uses your name and Chime account details. A sudden wave of convincing Chime-branded scam texts can be a sign your contact information is circulating.

If you find fraud, report it to Chime and your bank right away, file an identity theft report at the FTC's IdentityTheft.gov, and keep copies. Those records are the kind of proof courts in data breach cases have been asking plaintiffs to produce, and the kind of documentation settlements pay more for. Without any sign of misuse, a data breach claim based only on the outage is much harder to win.

No settlement means no claim deadline yet. What you should know about timing:

• The key date is April 1, 2026. Costs and fraud after that date are what the cases focus on.
• Class membership is automatic while proposed class actions are pending, and filing generally pauses the statute of limitations for class members.
• Individual claims have their own clocks, usually 2 to 4 years for negligence and consumer claims in most states, and shorter periods for disputing electronic transfers with your bank. Report unauthorized transfers to Chime promptly, since federal rules tie your protection to how fast you report.

1. Save proof of the outage's impact: screenshots, late notices, overdraft or late fees, and any messages with Chime support from April 2026.
2. Change your Chime password and turn on every login protection the app offers. Do this even though Chime denies a breach.
3. Freeze your credit with the three bureaus. It is free and stops new accounts in your name.
4. Watch for scams. Fraudsters use breach headlines to send fake "Chime settlement" messages. No claim process exists. See our guide on settlement scams.
5. Keep any notice if Chime ever sends one about a security incident.

Our checklist on what to do after a data breach notice covers each step in detail. If you had identity theft or real losses tied to Chime, independent attorneys who handle data breach and banking cases can look at your options. A free case review takes about two minutes. For how these cases usually unfold, see our overview of data breach lawsuits.