Data breach settlement claims: how they pay and what to claim
Data breach settlement claims explained: flat cash, documented losses up to the cap, lost-time pay and credit monitoring — what proof works and how to file.
A data breach settlement claim typically offers four things: a flat cash payment (often $50–$125, sometimes pro rata), reimbursement of documented out-of-pocket losses up to a cap (commonly $5,000–$10,000), payment for time spent dealing with the breach (usually 3–10 hours at $20–$25 per hour), and free credit monitoring. You can usually claim several at once, and the flat payment needs no proof. The largest open example in our directory is the Bank of America data breach settlement ($425M fund; $50 flat plus up to $600 for documented losses; no proof for the flat tier; ends Nov 20, 2026). Here's how to get everything you're entitled to.
Why data breach settlements are everywhere
The Identity Theft Resource Center counted 3,158 publicly reported data compromises in 2024 and roughly 1.7 billion victim notices — and every sizeable breach now draws a class action within weeks. The suits allege negligence (inadequate security, missing multifactor authentication), breach of contract and state consumer-protection violations; California's privacy law adds statutory damages of $100–$750 per consumer per incident for certain breaches, which is why many settlements include a California subclass with an extra payment. Companies settle because discovery is expensive and the damages theories are hard to cap. The results range from Equifax's 2019 deal (a $425M consumer fund, run through the FTC) and T-Mobile's $350M settlement in 2022 to dozens of smaller hospital, retailer and school-district cases paying a few hundred thousand dollars each.
For you that means two things: if you've had a breach notice in the last five years, you're probably a class member somewhere, and the notice email you assumed was phishing may be the claim itself (how to verify a settlement email in two minutes). Claims are run by court-appointed administrators — the companies behind the emails are explained in what is a settlement administrator.
The four benefits in a typical data breach settlement claim
Most breach settlements let you stack benefits rather than choose one. The names vary by case, but the structure below is nearly universal. One caution from Equifax: its "alternative" $125 cash option was advertised widely, far more people chose it than the fund could support, and the FTC warned that payments would be much smaller — so treat any flat amount that is pro rata as an estimate, not a promise.
| Benefit | Typical amount | Proof needed? | Notes |
|---|---|---|---|
| Flat / alternative cash payment | $50–$125 (pro rata up or down) | No | Everyone in the class; often the only tier most people file |
| Documented out-of-pocket losses | Up to $2,500–$10,000 (Equifax: $20,000) | Yes — receipts, statements | Must be fairly traceable to the breach and within the window |
| Lost time | 3–10 hours at $20–$25/hour | Attestation (sometimes a short description) | Claimable even with no money lost; most people forget it |
| Credit monitoring / identity restoration | 2–3 years, roughly $100–$300 retail value | No | Often claimable alongside cash; sometimes instead of it |
| Extraordinary losses / identity theft | Up to $25,000 in some cases | Yes — police or FTC report, statements | For actual fraud losses not reimbursed elsewhere |
| California statutory subclass | $100–$750 extra in some settlements | California residency | Based on CCPA statutory damages |
Documented losses: what counts and what gets rejected
"Documented losses" means money that left your pocket because of the breach and wasn't reimbursed by anyone else. Administrators routinely accept: fraudulent charges your bank didn't refund, fees for credit freezes or monitoring you bought after the breach, replacement-card and notary fees, postage, and professional fees (a credit-repair service, an accountant untangling a fraudulent tax return). They routinely reject: losses already refunded by a bank or card issuer, fraud that predates the breach, losses outside the claim window, and round-number estimates with nothing attached. Lost-time claims are easier — you attest to the hours (reading notices, freezing credit, calling banks) and, in some cases, write a sentence describing them. Build the documented claim like this:
- Pin down the breach window. The notice states the breach date and the period losses must fall in (usually from the breach through the claim deadline).
- Pull statements. Highlight unreimbursed fraudulent charges and any fees you paid for freezes, monitoring or card replacement.
- Collect receipts and reports. Monitoring invoices, notary and postage receipts, and — for identity theft — the report you filed at IdentityTheft.gov or with the police.
- Total the hours. Keep it honest and specific: "2 hours freezing credit at three bureaus, 1 hour with my bank's fraud line."
- File the flat payment and monitoring too if the settlement allows stacking — they don't depend on the documented claim being approved.
- Answer deficiency notices fast. Missing a cure deadline usually drops you to the flat tier or zero.
Worked example: the Bank of America data breach settlement
Our Bank of America data breach settlement page shows the standard structure in practice: a $425M fund; a $50 flat payment anyone in the class can claim with no proof; and up to $600 in documented losses for people who can show breach-related costs. Claims close Nov 20, 2026. A sensible claim for most people is both tiers — the $50 takes two minutes, and if you paid for monitoring or absorbed a fraudulent charge you add that with a statement screenshot. If you received a notice, the claim or notice ID on it pre-fills the form; if you didn't, you can generally still file and attest that you were affected (claim ID vs. notice ID, and filing without one). Payment comes after final approval, typically 6–18 months from the deadline. Other open cases with a no-proof cash tier sit alongside it in the settlements directory, and the full list of no-receipt options is in class action settlements with no proof required.
Cash or credit monitoring?
When a settlement makes you choose, the math is usually simple. Credit monitoring is worth its retail price only if you'd otherwise buy it; most people have been in enough breaches that they already hold two or three overlapping subscriptions, and a free credit freeze at Equifax, Experian and TransUnion blocks new-account fraud better than monitoring does. Take the monitoring if you have none and your Social Security number was exposed; take the cash otherwise — and remember a pro rata flat payment can end up well below the advertised figure if claims pour in. The full decision framework, including identity-restoration services, is in data breach settlement: take the cash or the credit monitoring?
Mistakes, audits and taxes
- Skipping lost time. At $25 an hour, five honest hours is $125 — often more than the flat payment — and nearly everyone leaves it unclaimed.
- Claiming reimbursed fraud. If your bank refunded the charge, it isn't a loss; administrators cross-check and may reject the whole documented claim.
- Duplicate or family claims. One claim per affected person; a spouse who was separately notified files separately.
- Ignoring the cure notice. Deficiency emails come from the administrator's domain and usually give 14–30 days.
- Taxes. Reimbursement of money you lost isn't income; a flat payment that exceeds any actual loss can be, and interest always is. Administrators rarely issue 1099s for amounts under $600. See IRS Publication 4345 and do you pay taxes on class action settlement money.
Not legal or tax advice: each settlement's terms govern, and the administrator and court decide eligibility and amounts.
How to find every data breach settlement you're in
Breaches cluster: the same email address tends to show up in retailer, health-system and telecom incidents year after year. Search your address at Have I Been Pwned to see which breaches you're in, then check the administrator sites and aggregators for matching settlements (how to find open class action settlements). Or let software do it: Owed matches you against every open case, files the no-proof tiers for free, flags the ones where a documented claim is worth the effort, and reminds you before each deadline.
Glossary
- Documented losses
- Unreimbursed, out-of-pocket costs fairly traceable to the breach — fraud charges, monitoring fees, notary and postage — paid up to a cap with receipts or statements.
- Lost time
- Hours spent dealing with the breach (freezing credit, calling banks), reimbursed at a fixed hourly rate, usually $20–$25, up to a cap of 3–10 hours.
- Alternative cash payment
- A flat payment offered instead of (or alongside) credit monitoring; often pro rata, so the final amount depends on how many people claim it.
- Pro rata
- Scaling every valid claim by the same factor so total payments equal the money available in the fund.
- Credit monitoring
- A service that alerts you to changes on your credit reports; settlements typically provide two to three years free.
- Fairly traceable
- The standard administrators use for documented losses: the cost must plausibly result from the breach, not from unrelated fraud.
FAQ
Most people who file the no-proof tier get $50–$125, adjusted pro rata. Adding lost time ($20–$25 an hour, 3–10 hours) and documented losses (capped at $2,500–$10,000 in most cases) can raise that into the hundreds.
Not for the flat cash payment, credit monitoring or (usually) lost time — an attestation is enough. Documented out-of-pocket losses require statements, receipts or an identity-theft report.
Unreimbursed fraudulent charges, fees for credit freezes or monitoring bought after the breach, replacement-card, notary and postage costs, and professional fees — all within the settlement's window and traceable to the breach.
Yes. Lost-time reimbursement is separate from documented losses; you attest to the hours you spent responding to the breach, and many settlements pay it on top of the flat payment.
Take the cash if you already have monitoring or have frozen your credit; take the monitoring if you have neither and your Social Security number was exposed. Some settlements let you claim both.
Typically 6–18 months after the claim deadline: the court holds a final approval hearing, any appeals run their course, then the administrator reviews documented claims and pays everyone at once.
- Identity Theft Resource Center — 2024 Annual Data Breach Report
- FTC — Equifax data breach settlement
- FTC — What to know about credit freezes and fraud alerts
- FTC — IdentityTheft.gov (report identity theft, get a recovery plan)
- Have I Been Pwned — check which breaches include your email
- IRS Publication 4345 — Settlements: taxability
This article is based on public information as of Aug 22, 2026; features, prices and deadlines change. Owed is not a law firm and nothing here is legal, tax or financial advice. Corrections →
Keep reading
Data breach settlement cash or credit monitoring: which to pick?Data breach settlement cash or credit monitoring? When the cash wins, when monitoring is worth more, and how documented-loss claims add up to $600 on top.
Class action settlements with no proof required (and 8 open now)Class action settlements no proof required: how sworn-statement claims work, payout caps and audits, plus the 8 open no-proof settlements you can file for now.
Proof of purchase for class action claims: what counts, where to lookProof of purchase for a class action claim: what counts (receipts, order emails, statements, screenshots), where to find it fast, and what to do without it.