Data Breach Class Actions: How to Join and Claim

This article is for educational purposes only and does not constitute legal advice. Consult a qualified attorney for advice about your specific situation.

The settlement email most people ignore

Check your deleted folder. Somewhere in there, probably flagged as spam, is an email with a subject line like “Notice of Proposed Class Action Settlement” or “[Company Name] Data Breach Settlement Administrator.” It looks like junk. The sender is a law firm you’ve never heard of. You deleted it.

That email was money.

The Equifax settlement was worth at least $575 million (with a consumer fund of $425 million). The T-Mobile settlement was $350 million. Capital One paid $190 million. Yahoo paid $117.5 million. These funds exist to compensate you. But to receive anything, you have to file a claim — and most people never do.

The claim form takes roughly 10 minutes to fill out. It costs nothing to submit. No lawyer is required. The only thing standing between you and a check is not knowing the settlement exists and not submitting the form before the deadline.

That’s what this guide fixes.

The short answer: To join a data breach class action, confirm you’re in the affected class and find the official claim form on the settlement administrator’s site. Then choose your tier and file before the deadline. A Tier 1 (base) claim needs no documentation and takes about 10 minutes. A Tier 2 claim reimburses documented losses and can reach a $25,000 ceiling. It costs nothing and needs no lawyer. The only thing that stops most people is missing the settlement notice or the deadline.

In this article:

What is a class action lawsuit?

A class action lets one or more “named plaintiffs” sue on behalf of everyone who suffered the same harm. These named plaintiffs — usually a handful of people — represent the “class”: all the other victims who experienced the same breach or violation.

When a court certifies the class, it’s ruling that the case is appropriate for class treatment. That means the claims are common enough across thousands or millions of people that litigating them individually would be impractical. Once certified, the case proceeds for everyone in the class, whether they know about it or not.

Most class actions settle before going to trial. The company agrees to pay a lump sum into a settlement fund. That fund then gets divided among class members based on the tier of harm they’ve documented. The law firms that brought the case collect attorney fees — typically 25–40% of the settlement — off the top.

You don’t pay anything. You don’t need to hire a lawyer. You just need to file a claim.

The lifecycle of a data breach class action

Understanding the timeline explains why you wait years for a check. Here’s every stage, in order.

Stage 1: Breach occurs and becomes public. Companies are required to disclose material breaches, and news coverage often follows within days. The moment a breach is announced, law firms start investigating.

Stage 2: Law firms file suit. Within days or weeks of a major breach announcement, multiple plaintiff-side law firms file class action complaints in federal court. They’re often consolidated into a single case.

Stage 3: Class certification motion. The plaintiffs ask the court to formally certify the case as a class action. The company fights this. Briefing and hearings take months.

Stage 4: Discovery. Both sides exchange evidence — internal emails, security reports, breach forensics. This phase regularly takes one to two years. It’s where the real negotiation leverage is built.

Stage 5: Settlement negotiations. Most cases settle here, after discovery but before trial. Both sides know what the evidence shows and calculate the risk of going to a jury.

Stage 6: Preliminary settlement approval and notice to class members. The court gives preliminary approval, and a settlement administrator sends notice to affected individuals. This is the email you deleted.

Stage 7: Claims period. Class members have a window — typically 60 to 120 days — to submit claims. Miss this deadline and you receive nothing, regardless of how badly you were affected.

Stage 8: Final court approval. The court holds a fairness hearing. Class members can object. The judge approves or rejects the settlement.

Stage 9: Distribution. Money goes out to everyone who filed a valid claim.

Total time from breach to payout: typically two to five years. The Equifax breach happened in 2017. Most claimants received their payments in 2022–2023.

What do you actually receive? The major settlements

Numbers help. Here’s what the biggest data breach settlements actually paid out.

Equifax (2017 breach, 147 million affected): The FTC announced a settlement of at least $575 million, with a consumer fund of $425 million — the $700 million figure cited in some coverage was the ceiling of the range, not the settled amount. Victims with documented losses — fraudulent accounts, professional fees, hours spent on identity theft recovery — received up to $20,000. People who chose credit monitoring instead got four years of free monitoring through Experian. Those who requested the $125 cash option (instead of monitoring) received less after the claims volume exceeded the fund’s cash allocation. Documented loss claimants averaged around $500.

Facebook/Cambridge Analytica (settlement approved 2023): $725 million total — the largest privacy-related settlement in US history at the time. Most claimants received $2–$30 depending on how long they’d had a Facebook account and how many people filed.

T-Mobile (2021 breach, 76 million affected): $350 million settlement. Documented loss claimants received up to $25,000. Base claimants — those with no out-of-pocket losses — received approximately $25.

Capital One (2019 breach, 100 million affected): $190 million. Same structure: up to $25,000 for documented losses, around $25 for base claimants.

Yahoo (2013–2016 breaches, 3 billion accounts across multiple incidents): $117.5 million. Accounts with two-factor authentication enabled received up to $100. Standard accounts received up to $25.

Marriott (2018 breach, approximately 383 million records): Litigation is ongoing as of 2026.

The pattern is consistent. Base claimants — people with no documented financial harm — receive $25 to $125. People who can prove actual losses receive significantly more. The ceiling in most settlements is $25,000, but reaching it requires documentation.

The two claim tiers in most settlements

Every data breach class action settlement structures payouts in tiers. Knowing the difference determines how much you receive.

Tier 1 — No documentation required. You are in the breach. You submit a claim form. You receive the base amount. That’s the entire requirement. You don’t need bank statements. You don’t need police reports. You just need to confirm you were affected and submit before the deadline. Base amounts across major settlements have ranged from $25 to $125. This is the fastest path and the one most people take.

Tier 2 — Documented losses required. If you suffered actual financial harm from the breach, you file for reimbursement. This covers fraudulent charges on your accounts, costs of credit monitoring services you paid for, professional fees (attorneys, accountants) for resolving identity theft, and time spent on resolution — typically calculated at $25 per hour. You’ll need to submit bank statements, receipts, and records. The claim form walks you through exactly what documentation to attach. Payouts here range from a few hundred dollars to the settlement maximum.

Some settlements include a third tier for severe identity theft — documented cases where someone opened fraudulent accounts or filed false tax returns using your information. These claims can reach the $25,000 ceiling.

The rule of thumb: always at least file a Tier 1 claim. It costs 10 minutes. If you spent real money resolving identity theft, go for Tier 2 and gather your paperwork.

Illinois BIPA: the exception with real money

Most class action settlements produce modest per-person payouts because the settlement fund gets split among millions of claimants. Illinois is different.

The Illinois Biometric Information Privacy Act (BIPA) awards $1,000 to $5,000 per violation as statutory damages — meaning you don’t have to prove individual harm. If a company collected your face scan, fingerprint, or voice print without proper notice and consent, each collection is a separate violation worth $1,000 (negligent violation) or $5,000 (intentional violation).

This structure explains why TikTok’s $92 million settlement was so large. It included significant BIPA claims from Illinois residents whose biometric data was collected without consent, alongside other state privacy law claims. Facebook’s $725 million settlement in 2023 resolved claims arising from the Cambridge Analytica data-sharing scandal — claims under federal and state privacy laws, not BIPA. Facebook also settled a separate BIPA facial recognition lawsuit for $650 million.

Are you an Illinois resident? If you used an app with Face ID, tagged yourself in social-platform photos, or clocked in and out of work with a fingerprint scanner, check whether the company faces BIPA litigation. The per-claimant amounts in BIPA settlements are meaningfully higher than in standard breach settlements. Our guide to biometric data rights explains how BIPA claims work.

How to find active class actions you qualify for

You don’t need to wait for a settlement email. These resources let you search for cases yourself.

ClassAction.org tracks active and settled class actions across the US. It has a search function where you can type a company name and see whether any litigation is pending or settled. It also tracks claim deadlines — the piece most people miss.

TopClassActions.com covers class action news and maintains a database of active settlements with deadlines listed prominently. Subscribe to their email alerts for your state and industry.

PACER (pacer.gov) is the federal court’s public filing system. Every federal class action is filed there. Searching by company name shows every case filed, even ones the company hasn’t publicized. Registration is free; documents cost $0.10 per page, though the first $30 per quarter is waived.

Your email inbox. Search for “class action settlement notice,” “settlement administrator,” and the name of any company that’s had a breach you were part of. Check your spam folder. Check your deleted folder. Settlement notices are sent to your email address on file with the breached company — which is often an old address.

Law firm case pages. Many plaintiff-side law firms that file breach class actions maintain “join the case” pages on their websites. A Google search for “[company name] data breach class action” usually surfaces these quickly.

The US class action has no direct equivalent in the EU or UK — but mechanisms exist.

In the UK, the primary vehicle is the Group Litigation Order (GLO), which consolidates individual claims sharing common issues. The Lloyd v Google case concerned Google’s “Safari Workaround” — Google exploited an exception in Apple Safari’s default cookie-blocking to set DoubleClick advertising cookies on iPhones without user consent. The Supreme Court ultimately dismissed the representative action on the basis that “mere loss of control” over personal data is not sufficient damage without proof of individual harm. Current active UK group litigation includes cases against British Airways (the 2018 breach affecting 420,000 customers) and Marriott (same 2018 breach, UK victims).

The EU’s Collective Redress Directive, which member states were required to implement by 2023, enables qualified entities (consumer organizations, advocacy groups) to bring representative actions on behalf of consumers across borders. These aren’t class actions in the American sense — individual consumers don’t file claims the same way — but they can produce compensation orders that flow to affected individuals.

If you’re in the EU or UK and were affected by a breach, start by filing a complaint with your national data protection authority. That means the ICO in the UK, the CNIL in France, the BfDI in Germany, and so on. These complaints can trigger regulatory fines against the company. In some cases they also create the factual record that supports follow-on civil litigation.

How to submit a claim: the practical steps

When a settlement is announced and you’re in the class, here’s the exact process.

Verify you’re in the class. Check the settlement’s official website (listed in the settlement notice or on ClassAction.org). Most settlement sites have a lookup tool where you enter your email address or name to confirm eligibility. You can also check HaveIBeenPwned (haveibeenpwned.com) to see whether your email appears in known breach datasets.
Find the claim form. It’s on the settlement administrator’s website. Do not submit through any other website. Settlement scams exist — they send you to fake claim sites and harvest your information. Always verify the URL against what’s listed in official court documents.
Choose your tier. Decide whether you’re filing a Tier 1 (base) claim or a Tier 2 (documented losses) claim before you start. Gather documentation before you open the form so you’re not hunting for bank statements mid-way through.
Complete the form before the deadline. Claim deadlines are hard. There are no extensions and no exceptions. Missing the deadline means receiving nothing — courts won’t make accommodations for late filers. Set a calendar reminder the moment you learn about a settlement.
For Tier 1: You’ll typically provide your name, current address, email address, and confirmation that you were affected by the breach. Some settlements require a claim ID from the settlement notice email.
For Tier 2: Attach bank or credit card statements showing fraudulent charges (with unrelated transactions redacted), receipts for paid credit monitoring services, professional invoices for legal or accounting help, and a log of hours spent resolving identity theft issues.
Record your submission. Screenshot or save the confirmation number. Keep it somewhere you’ll find it in two years — which is roughly when distribution happens.
Track the case. Bookmark the settlement administrator’s website. Check it every few months. Cases occasionally hit delays, have distribution timelines pushed back, or (rarely) get rejected by the court and require resubmission.

Frequently asked questions

How do I join a data breach class action? Confirm you’re in the affected class on the settlement’s official site, then file the claim form before the deadline. You don’t sign up in advance. Once a class is certified, you’re already in it, but you must file to get paid.

Do I need a lawyer or money to file a claim? No. Filing a Tier 1 base claim is free and takes about 10 minutes. Law firm fees come out of the settlement fund, not your pocket.

How long until I get paid? Typically two to five years from breach to payout. The 2017 Equifax breach paid most claimants in 2022–2023.

What if I missed the claims deadline? You generally get nothing. Deadlines are hard, with no extensions. Set a reminder as soon as you learn of a settlement, and check for other active cases at ClassAction.org.

Is class action or a GDPR claim better? In the US, class actions pay small base amounts unless you document losses. In the UK/EU, individually assessed GDPR claims often pay more per person. See our UK compensation guide.

What you can do right now

Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. That kind of documentation is directly relevant to establishing harm in a compensation claim. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist to get in early.