Snowflake lawsuit: what it's about and what customers could get

What happened with Snowflake in 2024

Snowflake is a cloud data-warehouse company — big companies store customer records inside Snowflake accounts they control. In mid-2024, security researchers and Snowflake itself reported that a threat actor was accessing customer environments using stolen login credentials, largely against accounts that did not have multi-factor authentication (MFA) enforced. Snowflake has said its own platform was not breached; instead, individual customer accounts were compromised.

Reporting from Mandiant (Snowflake's incident-response partner) and mainstream outlets pointed to a broad campaign affecting roughly 165 organizations that used Snowflake. High-profile companies later disclosed incidents connected to the campaign, including AT&T (call and text metadata for tens of millions of customers), Ticketmaster/Live Nation, Advance Auto Parts, Santander, Neiman Marcus and LendingTree's QuoteWizard, among others. Because so many downstream customers were affected, the resulting lawsuits target both Snowflake and the individual companies whose data was taken.

What the lawsuits actually allege

There is no single "Snowflake class action." Multiple suits have been filed in federal courts against Snowflake and against its affected customers. According to the public complaints, plaintiffs generally allege some combination of negligence, breach of implied contract, violations of state consumer-protection laws, and (against certain companies) violations of the federal Stored Communications Act or state biometric/privacy statutes.

The common thread is that defendants allegedly failed to enforce basic security controls — most notably MFA — on accounts holding sensitive personal data, and failed to notify affected consumers quickly enough. Snowflake, for its part, has publicly maintained that customer misconfiguration and stolen credentials were the root cause, not a flaw in the platform. These are allegations, not findings; the courts have not ruled on the merits. If you want a primer on how these cases move through the system, see what a class action lawsuit is and how one actually works.

Who could qualify if a case settles

Because the incidents span many downstream companies, "qualifying" depends on which defendant's case you're looking at. Class definitions in complaints filed so far generally cover U.S. consumers whose personal information was stored in the affected environment during a specific class period disclosed by that company.

Rough breakdown of who might be swept in if these cases certify and settle:

• AT&T call/text metadata suits — U.S. customers with wireless service between roughly May 2022 and October 2022 and January 2023, per AT&T's own notice.
• Ticketmaster/Live Nation suits — account holders whose data was in the exposed set (Ticketmaster estimated a large North American user population).
• Retailer suits (Advance Auto Parts, Neiman Marcus, others) — customers who received a data-breach notice from that specific retailer.
• Direct Snowflake suits — potentially broader, but harder to certify since most consumers had no direct relationship with Snowflake.

See who is eligible for a class action settlement for how these class definitions get drawn.

Realistic payout expectations

Nothing is settled yet, so any dollar figure is an estimate based on comparable breach cases. Data-breach settlements typically offer a small flat payment (often $25–$100) for anyone in the class who files, plus reimbursement of documented out-of-pocket losses (fraud, credit-monitoring, time spent, sometimes up to $5,000–$25,000 with receipts). A few years of free credit monitoring is common on top of cash.

Current status and what to watch

As of this writing, the Snowflake-related suits are in early stages — mostly at the motion-to-dismiss or class-certification phase in various federal district courts. Some cases have been consolidated through multidistrict litigation (MDL) mechanics; others remain separate against individual defendants. Expect at least 12–24 months before any meaningful settlement emerges, and likely longer for the more complex defendants like AT&T where damages calculations are heavily disputed.

Milestones to watch:

• Class certification decisions — a judge deciding the case can proceed on behalf of a defined group.
• Preliminary settlement approval — the point at which claim forms typically become available.
• Notice program launch — email/postcard/website notice from a court-approved administrator (Epiq, Kroll, Angeion, JND and similar).
• Final fairness hearing — the court's last review before payouts start, usually 3–6 months after preliminary approval.

The Owed settlements directory lists cases that have reached the claims stage.

How to file — or get notified when you can

Right now there is no open claim form for a "Snowflake settlement" because no Snowflake-related case has reached the claims stage. Anyone selling you a filing service for one is running a scam. When a real claim window opens, filing is free and takes a few minutes on the administrator's website.

1. Confirm you received an official data-breach notice from AT&T, Ticketmaster, Neiman Marcus or another affected company — save it.
2. When a settlement is announced, find the administrator's website (linked in the court order and the class notice) and check the class definition.
3. Gather any receipts for fraud, unreimbursed charges, credit-monitoring fees or lost time between the breach date and today.
4. File the claim form on the administrator site before the deadline — pick a payment method (bank/check/prepaid card).
5. Save your claim number and the administrator's contact info. Payouts usually arrive 3–9 months after the final fairness hearing.

How to spot fake settlement emails

High-profile breaches attract phishing. Real settlement notices come from a court-approved administrator, link to a website that matches the case name, and never ask for your Social Security number, bank password, or a payment to file. If an email pressures you to click quickly or wire money to "release" a payout, it's a scam — full stop.

Quick sanity checks before you click:

• Is the sender domain one of the well-known administrators (epiqglobal.com, kroll.com, angeiongroup.com, jndla.com, veritaglobal.com)? Type it into your browser instead of clicking.
• Is the case listed on classaction.org/settlements or the court's own PACER docket?
• Does the class period match a breach notice you actually received?
• Filing is always free. Nobody legitimate takes a fee up front.

For a broader walkthrough, see how to check if you're part of a class action and how to find open settlements.

What Owed does in the meantime

Owed monitors court dockets and administrator sites for new settlements, matches them to your profile from a 9-question quiz (and, optionally, receipts from a connected inbox), and files claims for you when a case you qualify for opens. If any of the Snowflake-linked cases reach the claims stage, members whose profiles match the class definition get an alert and, in most cases, a pre-filled form.

You can also self-file — nothing about our approach requires paying us. Filing directly on the administrator's website is always free, and we take no cut of self-filed payouts. See how to file a class action claim for the DIY route. Note: this article is general information, not legal advice — if you had significant losses from a Snowflake-linked breach, talk to an attorney about opting out of any eventual class to preserve individual claims.

Glossary

Class period

The date range during which someone must have been affected to fall inside the proposed class.

MDL (Multidistrict litigation)

A federal procedure that consolidates related cases from different districts before one judge for pretrial proceedings.

Class certification

The court's decision that a case can proceed on behalf of a defined group rather than just the named plaintiffs.

Settlement administrator

The court-approved company (e.g., Epiq, Kroll, Angeion) that handles notice, claim forms and payouts.

Documented losses

Out-of-pocket costs — fraud, credit monitoring, time — that class members can claim with receipts, usually on top of a flat payment.

Notice program

The court-approved plan for reaching class members via email, mail, digital ads and a dedicated website.

FAQ