The Arby’s lawsuit claim form is no longer being accepted. The claims filing period for In re: Arby’s Restaurant Group, Inc. Data Security Litigation closed in mid-2019, and the settlement is now fully resolved. If you’re arriving here hoping to submit a claim tied to the 2016–2017 payment card breach, that window has shut and cannot be reopened. What’s below explains what the form required, what claimants could recover, and what to do if you received a payment and have a tax question about it.
Why the Form Is No Longer Available
The case, filed as Case No. 1:17-cv-1035-AT in the U.S. District Court for the Northern District of Georgia, resolved through a class settlement administered by KCC Class Action Services. Claims had to be postmarked or submitted online by the deadline in 2019. After the window closed, the court held a final fairness hearing, approved the settlement, and payments went out to claimants with approved claims. There is no late-filing procedure.
One boundary worth stating up front: only corporate-owned Arby’s locations were part of the breach and the settlement. Franchise-operated restaurants ran on separate payment systems and were never included, so purchases at franchise locations wouldn’t have qualified even during the filing period.
What the Claim Form Required
The form itself was short on personal information and heavy on documentation. Claimants filled in their full name, mailing address, city, state, ZIP code, telephone number, and email address.1Attorneys General. Settlement Agreement and Release They also had to identify the restaurant number of the Arby’s location where the card was used and the date of the purchase. A signed attestation certifying accuracy closed out the form.
There was no Notice ID or Confirmation Code on this claim form. Validation ran on proof of purchase instead.
Documentation You Had to Attach
Every claimant needed a copy of a purchase receipt, credit card statement, or bank statement showing the transaction at an affected location during that location’s exposure window.1Attorneys General. Settlement Agreement and Release Exposure windows were set restaurant by restaurant, so two customers could have needed different date ranges to qualify.
Anyone claiming fraudulent charges or card cancellation added copies of statements showing that activity. For unauthorized charges the bank refused to reverse, correspondence from the financial institution declining reimbursement had to be included. Claimants asking for reimbursement of other out-of-pocket costs attached receipts or records for each expense. Only copies were to be submitted; the administrator did not return originals.
What Claimants Could Be Reimbursed For
Eligible class members could seek documented, unreimbursed out-of-pocket expenses in several categories:1Attorneys General. Settlement Agreement and Release
- Identity theft and fraud costs tied to affected accounts.
- Costs from restricted access to funds, such as loan interest or ATM fees when accounts were frozen.
- Preventative costs like credit monitoring, security freezes, and credit report requests, capped at $150 per claimant, for costs incurred between February 9, 2017 and the settlement announcement.
- Banking fees, including late fees, declined payment fees, overdraft fees, returned check fees, customer service fees, and card cancellation or replacement fees.
- Unreimbursed unauthorized charges the bank or issuer refused to reverse.
- Other documented breach-related losses not captured above.
No single claimant could receive more than $5,000 in combined reimbursement for expenses and time.2ABC11 Raleigh-Durham. Arby’s Agrees to Pay Up After Data Breach Arby’s total liability to consumers was capped at $2,000,000, and if approved claims had exceeded that pool, individual payments would have been reduced proportionally.
Time-Spent Compensation
Claimants who qualified for expense reimbursement could also claim time at $15 per hour, at one of two levels:1Attorneys General. Settlement Agreement and Release
- Self-certified time, up to $30 (two hours), for claimants without separate documentation of hours.
- Documented time, up to $75 (five hours), for claimants with records of how long they spent.
Time compensation only attached to hours spent remedying a loss that was itself reimbursable. You couldn’t claim hours without a qualifying underlying expense.
If You Received a Payment: Tax Considerations
Under the Internal Revenue Code, income is taxable unless a specific provision excludes it. The exclusion in IRC Section 104 covers damages for personal physical injuries or physical sickness, which does not fit data breach reimbursements.3Internal Revenue Service. Tax Implications of Settlements and Judgments The IRS looks at what the payment was meant to replace. A reimbursement for an out-of-pocket loss you already absorbed may restore you to your prior position rather than create new income, but the IRS has not issued guidance specific to data breach settlements.
If the settlement administrator paid you $600 or more in a single tax year, a Form 1099 would have been issued. Anyone unsure how to report a payment should ask a tax professional, since the answer depends on the nature of the reimbursement and your own circumstances.