This article is educational and does not constitute legal advice. Consult a qualified attorney for advice on your specific situation.
Equifax paid at least $575 million to settle the 2017 breach. You got $6.25. That gap between the headline and the cheque is the story of how data breach settlements actually work. Understanding it is the difference between walking away with nothing and receiving something meaningful.
The short answer: Most breach settlements pay a tiny base amount (often $5–$30) to anyone in the breach. The real money goes to a separate tier for people who document losses: fraud, stolen time, professional fees, and distress. Documented claimants routinely receive 10 to 100 times more. UK GDPR claims, assessed individually, pay far more per person than US class actions. The lesson is simple: keep receipts and file on time.
Why is there a gap between the headline and your cheque?
A settlement fund gets divided. Take Equifax: 147 million people were eligible to claim from a consumer fund of $425 million. (The $700 million figure was the ceiling of the FTC-announced range, not the settled amount.) The base amount per person is small for three reasons. Lawyers take fees, administration costs eat a portion, and the money is split across multiple tiers. People with documented losses draw from a higher tier. Everyone else competes for the base.
The base tier is deliberately small. Regulators and plaintiffs’ attorneys know most people will never document their losses. The settlement structure is built around that reality — which is exactly why the documented loss tier exists and why the per-person amounts there are so much higher.
Equifax: the case study in what documentation does
The 2017 Equifax breach exposed the financial and personal records of 147 million people: names, Social Security numbers, birth dates, addresses, and driver’s licence numbers. The FTC, CFPB, and 50 state attorneys general reached a settlement including up to $425 million in consumer compensation.
Every eligible person could claim one of two things: seven years of free credit monitoring, or a $125 cash payment. The $125 option was the headline. Then the FTC warned publicly that because millions of people had chosen cash, the per-person amount would be drastically reduced. For most claimants who chose cash, it came to $6.25.
The documented loss tier told a completely different story. People who could show identity theft or fraud directly linked to the breach were eligible for up to $20,000. Qualifying evidence included bank statements showing unauthorised transactions, time spent resolving fraud (compensated at up to $25/hour), credit monitoring costs, and professional fees paid to resolve identity theft.
The claimants who received meaningful amounts had paper — bank statements, phone logs, receipts for credit monitoring bought in a panic the week the breach was announced. The people who received $6.25 had nothing but their email address in the breach.
Facebook, T-Mobile, Capital One, Yahoo
Facebook/Meta (Cambridge Analytica, $725M, 2023). Every US Facebook user from 2007 to 2022 was eligible — approximately 190–210 million people. No documentation was required for the base claim. With over 26 million claims filed, per-person amounts landed at an estimated $2 to $30. No documentation required, and it showed.
T-Mobile (2021 breach, 76.6M affected, $350M settlement). T-Mobile offered up to $25,000 for documented losses: fraud, identity theft, professional fees, and time spent resolving them. The base for all claimants was $25. California residents received $100. All class members also got two years of identity theft protection through McAfee. This is a clear example of the tiered structure: $25 versus up to $25,000, separated entirely by documentation.
Capital One (2019, 98M+ affected, $190M settlement). Capital One offered up to $25,000 for documented losses; approximately $25 for base claimants. Priority claimants with documented unreimbursed losses averaged $500 to $1,000. The exposed data included Social Security numbers and bank account information — material, verifiable harm for many people who simply didn’t document it.
Yahoo (2013–2016 breaches, 3B accounts, $117.5M settlement). Yahoo’s settlement paid $100 to accounts with two-factor authentication enabled and $25 to other accounts, plus two years of credit monitoring. Three billion accounts were affected, so the settlement fund was relatively small. But the per-person amounts here were fixed rather than divided. The cap was the issue, not the pool.
British Airways: why UK GDPR beats US class actions for per-person payouts
The British Airways breach in 2018 exposed the personal and payment data of approximately 500,000 customers. The response wasn’t a US-style class action — it was a UK GDPR group litigation, which is a fundamentally different legal mechanism.
Rather than splitting a fixed fund among millions of claimants, UK GDPR claims are assessed individually. The group litigation against British Airways resulted in most claimants settling at £2,000 to £6,000 depending on distress severity and any documented financial harm.
Compare that to the US class action experience: $25 base, $125 capped. The difference isn’t that the British Airways breach was worse. The difference is the legal mechanism — individual GDPR claims produce individual assessments of individual harm. For anyone affected by a breach with UK or EU dimensions, pursuing a GDPR claim individually produces a consistently better per-person outcome.
Why does documentation change your payout so much?
Across every settlement above, the pattern is the same. Claimants with documented losses received 10 to 100 times more than base claimants. The breach severity didn’t determine the individual outcome. The paperwork did.
What to document after any breach:
- Fraudulent transactions. Bank and card statements with unauthorised charges highlighted and dated.
- Time spent resolving fraud. Keep a log — date, duration, what you did. Courts accept $25/hour in the US, £15–£25/hour in the UK for reasonable time spent on resolution.
- Credit monitoring costs. Receipts for any service purchased after the breach was announced.
- Professional fees. Solicitor, accountant, or credit repair invoices paid to address fraud.
- Distress. Contemporaneous notes — dated entries on anxiety, sleeplessness, disruption to daily life. GP records if you sought medical help. Witness statements from family who observed the impact.
Start this the day you learn of the breach. Evidence created at the time is far more compelling than a reconstruction written months later.
How to find out if you qualify for a current settlement
Settlement notices are mailed and emailed, but many people miss them. Three reliable places to check:
- ClassAction.org — searchable database of current settlements with claim deadlines
- TopClassActions.com — similar coverage with news on new settlements
- The settlement administrator’s website — listed in any official breach notification you received
Search for companies you’ve done business with in the past five years. Breaches are often disclosed long after they occurred, and settlements follow the breach by one to three years. You may be eligible for something you’ve never heard of.
Claim deadlines are strict. Courts do not grant extensions for individual claimants who missed the window. If you’re checking, check now.
Frequently asked questions
Why do breach settlements pay so little per person? A fixed fund gets split among millions of claimants after lawyer fees and admin costs. The base tier is deliberately small because most people never document losses. The documented-loss tier pays far more.
How much can I actually get from a data breach settlement? Base amounts often land at $5–$30. Documented-loss tiers reach $20,000–$25,000 in cases like Equifax, T-Mobile, and Capital One. Your paperwork, not the breach size, decides your tier.
Do I need a lawyer to claim? Not for filing a base or documented claim in a US class settlement. For UK GDPR group litigation or a Small Claims route, a no-win-no-fee solicitor can help. See our no-win-no-fee guide.
How do I find settlements I qualify for? Check ClassAction.org and TopClassActions.com, and search companies you’ve used in the last five years. Deadlines are strict and courts rarely grant extensions.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. That kind of documentation is directly relevant to establishing harm in a compensation claim. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist to get in early.