Data Breach Lawsuit: How to Join, Who Qualifies, and What You Can Get

A data breach happens when someone without permission gets access to personal information a company holds: names and addresses, Social Security numbers, card numbers, medical records, or passwords. A data breach lawsuit is usually a proposed class action brought by a few affected people on behalf of everyone whose data was exposed.

These suits typically say the company failed to use reasonable security, waited too long to warn people, or both. They are filed fast. In the 2026 Carnival breach, the first class actions were filed on April 22, 2026, the same day Carnival determined personal data had been copied and more than a month before it mailed notices. In the 2026 Charter Spectrum breach, nine separate suits were filed within about two weeks.

Recent examples on our site show the range of outcomes:

• Ticketmaster: part of a large federal MDL, core claims survived dismissal, now in discovery.
• Carnival: seven suits consolidated in Miami within weeks.
• Spectrum: nine suits consolidated in Connecticut, waiting on a consolidated complaint.
• Crunchyroll: breach suits voluntarily dismissed within three months.

Other breach cases on our site include Chime, where the company denies that any member data was taken at all, a reminder that not every "breach" headline describes a confirmed theft of personal data.

A lawsuit is only a set of allegations until a court rules or the company settles. Many breach cases settle, some are dismissed, and a few are dropped by the plaintiffs themselves.

Here is how it works in practice, step by step:

1. The company sends notices. Every state has a breach notification law that requires companies to tell people when certain personal information is compromised. Keep that letter or email.
2. Lawyers file proposed class actions. You do not need to sign up. The class is defined by the facts, such as "all persons whose information was compromised in the breach."
3. Cases are combined. Similar suits are usually consolidated in one court, or in a multidistrict litigation when they are spread across the country.
4. The case settles, is dismissed, or goes on. If it settles, the court grants preliminary approval and a notice goes to class members with a claim deadline.
5. You file a claim. This is the step that gets you paid. You file on the official settlement website named in the notice, or by mail.
6. The court grants final approval and, after any appeals, the administrator sends payments.

You do not need a lawyer to file a claim in an approved settlement, and filing is free. You may want one if your losses are large, because a settlement can release those claims for a small payment. You can also opt out and keep your right to sue on your own.

Settlement classes are usually defined by who received notice or whose data was in the affected system. Within the class, what you can claim depends on what happened to you:

Your situation	What you can usually claim
Got a notice, no problems since	Flat payment or monitoring
Spent time dealing with it	Hourly lost-time payment
Paid for freezes or monitoring	Reimbursement with receipts
Identity theft or fraud losses	Documented losses up to a cap

The type of data matters. Breaches that exposed Social Security numbers, government ID numbers, bank data, or medical records tend to produce larger settlements than breaches of email addresses alone, because the risk of real harm is higher.

Courts require a concrete injury. In TransUnion LLC v. Ramirez (2021), the Supreme Court held that only class members who suffered concrete harm have standing to seek damages in federal court. That is why lawyers and settlements ask for proof of fraud, costs, or time spent, and why breach claims based only on exposed email addresses often struggle.

Payouts depend on the settlement fund, how many people file, and what you can prove. The Equifax settlement, the best-known example, shows the typical structure. Equifax agreed to pay up to $425 million to help the roughly 147 million people affected by its 2017 breach, offering reimbursement of out-of-pocket losses up to $20,000 per person and $25 an hour for up to 20 hours of time spent. Class members could also choose an alternative cash payment of up to $125 instead of free monitoring.

Common benefit types in breach settlements:

• Documented losses: fraud charges not refunded, freeze fees, postage, notary and ID replacement costs, and sometimes professional fees, up to a cap.
• Lost time: usually a set hourly rate for a limited number of hours, with a short sworn statement.
• Alternative cash or pro rata payment: a flat or shared amount for anyone who files, often reduced when many people file.
• Credit or identity monitoring: often for 2 to 5 years. In the Capital One breach settlement, identity defense and restoration services run through February 13, 2028.
• Security changes: commitments the company must follow, which do not pay you but reduce future risk.

Flat payments are usually small in very large classes, often tens of dollars. State laws can add more for some people: the California Consumer Privacy Act allows California residents statutory damages of $100 to $750 per incident for certain breaches caused by unreasonable security. For real numbers from dozens of past cases, see how much a data breach settlement is worth. Open claims are listed on our settlements page, including the Labcorp and Globe Life breach settlements.

There is no single federal law that lets consumers sue for a data breach, so these cases rely on a mix of state law theories:

1. Negligence: a company that collects personal data must take reasonable care to protect it. Plaintiffs often point to FTC guidance and industry standards, such as multi-factor authentication and encryption, to show what reasonable care means.
2. Breach of implied contract and unjust enrichment: customers paid for services and handed over data expecting it to be protected.
3. State privacy statutes: California's CCPA, Cal. Civ. Code § 1798.150, gives a private right of action with statutory damages. Other states' consumer protection laws may apply as well.
4. Health and financial rules: HIPAA and federal banking privacy laws do not give individuals a right to sue, but their standards are often cited as the duty the company broke.

Many companies' terms of service include an arbitration clause. When courts enforce one, affected customers may have to bring claims individually instead of as a class.

Most people are best served by staying in the class and filing a claim when a settlement opens. It costs nothing, needs little paperwork, and does not require a lawyer. The trade-off is that you are bound by the settlement's release, so you give up the right to sue separately over the same breach.

An individual case can make sense when your harm is large and well documented, for example:

• Someone opened loans or credit cards in your name and you could not get them removed.
• Money was taken from your accounts and not returned.
• Your tax refund was stolen, or you faced collection actions for debts you never took on.
• Medical identity theft left false information in your health records.

To keep an individual claim, you must opt out of a class settlement by the deadline in the notice, usually a date before the final approval hearing. Opting out means you receive nothing from the settlement and must prove your own case, including that this particular breach caused your losses. That can be hard when your data has appeared in several breaches.

Some companies' terms require individual arbitration instead of court. In that setting, the company often pays most of the arbitration fees under consumer arbitration rules, and some law firms now file many individual arbitration claims at once. An attorney can tell you which path fits your situation.

Three kinds of deadlines matter:

• Settlement claim deadlines. Once a settlement is approved for notice, you typically have about 60 to 120 days to file. Miss it and you usually get nothing, even though you are still bound by the release. For example, the Equifax claim deadline was January 22, 2024, and the Capital One deadline was September 30, 2022.
• Opt-out and objection deadlines. These usually come before the final approval hearing. If you plan to sue on your own, you must opt out by this date.
• Statutes of limitations. For a lawsuit of your own, state statutes of limitations for negligence and consumer claims usually range from 2 to 6 years, often measured from when you learned of the harm. A pending class action generally pauses the clock for class members.

Also check the enrollment deadline for the free credit monitoring in your notice. It is separate from any lawsuit, and it often expires within a few months.

1. Read the notice to see exactly which data was exposed, and keep it.
2. Freeze your credit with Equifax, Experian, and TransUnion. It is free and blocks new accounts in your name.
3. Enroll in the free monitoring the company offers. It does not waive your right to a settlement.
4. Change passwords and turn on two-factor login for any account tied to the breach.
5. Keep records of every cost, fraud incident, and hour spent. This is what turns a $20 claim into a reimbursed loss.
6. Ignore anyone who charges a fee to "join" the lawsuit. Read our guide to settlement scams.

Our data breach notice checklist, linked in the guides below, covers each step. If you suffered identity theft, drained accounts, or other serious losses, independent attorneys who handle data breach cases can look at whether you have a stronger individual claim. A free case review takes about two minutes.