$2.45 Million Panda Express (Panda Restaurant Group) Data Breach Settlement: Claims Closed

According to the court-approved notice, an unauthorized third party may have accessed Panda Restaurant Group's files in a data security incident that occurred on March 7, 2024. The files included full names, dates of birth, and Social Security numbers. (The summary on the settlement website's home page says March 2023, but the notice and the court filings date the incident to March 2024.)

The proposed final approval order, reciting the complaint, says Panda discovered and disclosed the breach in April 2024 and sent notification letters on April 30, 2024 to approximately 215,000 current and former employees. The settlement class was later estimated at 240,295 people, 81,216 of them with California addresses.

Eight plaintiffs, led by Marc-Anthony Halliday, sued in Los Angeles Superior Court, claiming negligence, breach of implied contract, unjust enrichment, breach of the implied covenant of good faith and fair dealing, and breach of fiduciary duty. Panda denies the claims and any wrongdoing, and no court has found it liable. As part of the deal, Panda also agreed to take reasonable steps to further secure its systems. Those security commitments benefit every class member, including people who never filed a claim or received a payment. For how these cases usually unfold, see our data breach lawsuit guide.

You were in the settlement class if you live in the United States and your personal information was accessed or potentially accessed in the security incident, including if Panda mailed you a notification letter about it. The notice told people that, to be eligible to make a claim, they must have received a Notice of Data Breach letter about the March 7, 2024 incident.

• Most class members are current and former Panda Restaurant Group employees, since the exposed files were employee records.
• Ordering food from Panda Express as a customer did not by itself put you in the class.
• Excluded: Panda's employees, directors, officers, and agents (as defined in the notice), government entities, the judge and court staff, and anyone who opted out.

California residents qualified for an extra statutory payment estimated at $125 on top of the regular $100 cash payment. If you are unsure whether a letter you received was about this incident, call A.B. Data at 1-866-302-7373. Our guide on what to do after a data breach notice covers steps that protect you regardless of the settlement.

Benefit	Amount	Notes
Cash payment	About $100	Adjusted pro rata
California statutory payment	About $125 more	California residents only
Documented losses	Up to $5,000	Receipts required, losses on or after March 7, 2024
Credit monitoring	2 years, 3 bureaus	Includes identity theft insurance

All of this comes from a $2,450,000 non-reversionary fund. The fund first pays credit monitoring, then cash payments, after fees and costs. The proposed final approval order provides for attorneys' fees of $816,667.67 (one-third of the fund), $28,643.40 in costs, $288,133.25 to the administrator, and a $3,000 service award for each representative plaintiff.

Class counsel reported 7,806 claims after deduplication, only 8 opt-outs, and zero objections. Rough math: after the fees and costs above and eight $3,000 service awards, about $1.29 million remains for credit monitoring, documented losses, and cash. Paying 7,806 people $100 each would take about $781,000, so there may be room for cash payments to be adjusted upward, depending on how many Californians claimed and how much credit monitoring and documented losses cost. That is our estimate, not the administrator's. See how much a data breach settlement is worth for comparisons.

Documented loss claims needed proof of actual, unreimbursed costs incurred on or after March 7, 2024, such as credit monitoring you paid for, credit freeze or report fees, bank and card replacement fees, unreimbursed fraudulent charges, and reasonable travel, postage, or phone costs tied to fixing problems from the breach. Cash and California payments did not require documents. The administrator can ask for more information, and a claim is treated as invalid if the claimant does not respond in time.

Claims were submitted online, by the tear-off claim form mailed with the postcard notice, or by mail, by April 10, 2026. Class counsel credited the tear-off form for boosting participation.

1. The court granted preliminary approval on January 6, 2026.
2. Claims closed April 10, 2026.
3. The court heard the final approval motion on April 20, 2026.
4. After final approval and any appeals, A.B. Data validates claims and issues payments.

Payments that are not cashed within 90 days after distribution go to Children's Hospital Los Angeles. As of September 2026, the settlement website has not posted a payment date, and the final approval order posted there is an unsigned copy, so we cannot confirm when money will go out. If you filed, keep your contact details current with PRG Breach Settlement, c/o Settlement Administrator, P.O. Box 173073, Milwaukee, WI 53217, or info@PRGBreachSettlement.com. We do not file or track claims. Our guide on checking a settlement's status can help.

Event	Date
Security incident	March 7, 2024
Breach letters mailed	April 30, 2024
Preliminary approval	January 6, 2026
Opt-out and objection deadline	March 23, 2026
Claim deadline	April 10, 2026
Final approval hearing	April 20, 2026
Payments	Not yet announced

As of September 2026, all deadlines for the Panda Restaurant Group settlement have passed, and payment timing has not been announced. The notice warned that appeals, if any, could take more than a year, but no objections were filed, which makes an appeal less likely.

If you did not file by April 10, 2026, you will not receive cash or credit monitoring from this settlement, and unless you opted out by March 23, 2026, you have released your claims against Panda over this incident. Only 8 of roughly 240,000 class members opted out.

Because California residents make up about a third of the class (81,216 of 240,295 by Panda's records), the $125 California payment is a significant share of the cash budget. If you moved into or out of California, the administrator decides residency from the claim form and records.

If you are unsure whether you filed, contact A.B. Data with your name and address; the administrator can tell you whether a claim is on file and whether it was found deficient.

Even without a payment, you can still protect yourself. Because Social Security numbers were exposed, consider freezing your credit with Equifax, Experian, and TransUnion, which is free, and watch for tax-related identity theft. Our guide on what to do after a data breach notice walks through it.

Be careful with calls or texts offering to help you "claim" Panda settlement money for a fee after the deadline. See our settlement scams guide.

Data breaches that expose employee records often lead to settlements with similar benefit tiers: a flat cash option, documented losses, and credit monitoring. California residents often get an extra payment in these settlements because California law provides statutory damages for certain data breaches. Compare the Krispy Kreme data breach settlement and the Globe Life data breach settlement.

For this settlement, the official settlement website linked above is the only source for claim status. If your information from this breach was actually used for identity theft and you lost significant money, a free case review can connect you with independent attorneys who handle data breach cases.