Cybersecurity lawsuit news in mid-2026 is dominated by a handful of very large settlements now paying claims, a 192.7-million-person healthcare breach case grinding through pretrial discovery, and an aggressive new wave of state attorney general suits against tech and genetic-testing companies. Data breach class actions passed 1,800 federal filings in 2025, and the biggest money is finally reaching consumers from breaches that happened years ago.
Settlements Paying Out Right Now
Several large cybersecurity settlements are either distributing checks or accepting claims in 2026.
T-Mobile — $350 Million
T-Mobile’s $350 million settlement over the August 2021 cyberattack that compromised 76 million customers finally began distributing payments on May 30, 2026, after years of litigation and appeals.1The Hill. Long-Awaited T-Mobile Settlement Checks Finally Issued Claimants can receive up to $25,000 for documented identity theft losses, or up to $25 without documentation ($100 for California residents). T-Mobile also committed an additional $150 million to improving its data security.2Keller Rohrback. T-Mobile 2021 Data Breach All court proceedings are complete.
Comcast/Xfinity — $117.5 Million
Comcast has agreed to a $117.5 million settlement fund in Hasson v. Comcast Cable Communications, LLC to resolve claims from an October 2023 cybersecurity incident. The proposed settlement covers current and former Xfinity customers who received a breach notification in December 2023.3Comcast Breach Settlement. FAQ Eligible claimants can seek up to $10,000 for documented out-of-pocket losses, compensation for up to five hours of time spent at $30 per hour, or an estimated $50 alternative cash payment, plus three years of identity theft insurance with $1 million in coverage. The claims deadline is September 14, 2026, with a final approval hearing scheduled for August 5, 2026, in Philadelphia. Comcast denies any wrongdoing.4USA Today. Comcast Xfinity Settlement 2023 Data Breach
Lakeview Loan Servicing — $26 Million
A $26 million settlement in In re Lakeview Loan Servicing Data Breach Litigation received preliminary approval in February 2026 in the Southern District of Florida, resolving claims from an October 2021 breach of the mortgage servicer. Defendants include Lakeview Loan Servicing, Community Loan Servicing, Bayview Asset Management, and Pingora Loan Servicing.5ClassAction.org. $26M Lakeview Loan Servicing Settlement A final fairness hearing is set for July 2, 2026.6Lakeview Data Breach Settlement. Settlement Information
Smaller Settlements Closing This Summer
- Essen Medical Associates agreed to a $4 million fund over a March 2023 breach that exposed patient Social Security numbers and health insurance data.7Top Class Actions. 10 Class Action Settlements You Can Claim in June 2026
- Complete Payroll Solutions reached a $2.6 million settlement for a March 2024 payroll-data breach, with a June 18, 2026 claim deadline.7Top Class Actions. 10 Class Action Settlements You Can Claim in June 2026
- Krispy Kreme agreed to pay $1.6 million over a November 2024 breach involving payment card data and Social Security numbers.7Top Class Actions. 10 Class Action Settlements You Can Claim in June 2026
- Dove Healthcare settled a Wisconsin class action over a July 2024 cyberattack with a $150,000 fund; a final fairness hearing is set for July 20, 2026.8HIPAA Journal. Settlements Agreed to Resolve Two Class Action Healthcare Data Breach Lawsuits
- Blackstone Valley Community Health Care agreed to a $525,000 fund over a November 2023 breach.8HIPAA Journal. Settlements Agreed to Resolve Two Class Action Healthcare Data Breach Lawsuits
California also finalized a $12.75 million settlement with General Motors in May 2026 under the California Consumer Privacy Act, alleging GM sold geolocation and driving behavior data from its vehicles to Verisk and LexisNexis without notice or consent.9Clark Hill. Right to Know, June 2026 This is a state enforcement payment, not a consumer claim fund.
Change Healthcare: The Largest Active Breach Case
The February 2024 ransomware attack on Change Healthcare, a UnitedHealth Group subsidiary, is the single largest healthcare data breach ever recorded in the United States. UnitedHealth confirmed in August 2025 that the final count reached 192.7 million affected individuals. Attackers from the BlackCat/ALPHV group exploited a Citrix remote access portal that lacked multifactor authentication, and UnitedHealth paid a $22 million ransom that failed to prevent the data from staying compromised.10HIPAA Journal. Change Healthcare Responding to Cyberattack
Patient and provider lawsuits were consolidated into MDL No. 3108 in the U.S. District Court for the District of Minnesota before Judge Donovan W. Frank.11U.S. District Court, District of Minnesota. Change Healthcare, Inc. Data Breach On December 19, 2025, Judge Frank granted in part and denied in part the defendants’ motions to dismiss on both the patient and provider tracks, so significant portions of the case are moving forward. Fact discovery closes November 2, 2026, and Magistrate Judge Dulce J. Foster has been holding informal conferences to push settlement talks. No class certification ruling or global settlement has been reached, so there is nothing for consumers to claim yet.
Nebraska Attorney General Mike Hilgers filed a separate state suit in December 2024 against Change Healthcare, UnitedHealth, and Optum, alleging security failures and delayed notification to nearly 900,000 Nebraskans. Judge Susan Strong of Lancaster County District Court denied the defendants’ motion to dismiss in November 2025, and the case is in discovery.12Nebraska Attorney General. Court Allows Attorney General Hilgers’ Case Against Change Healthcare to Proceed
Snowflake: 500 Million People, One Cloud Vendor
Breaches exploiting the Snowflake cloud platform between April and June 2024 affected more than 500 million individuals across AT&T, Ticketmaster, Live Nation, Neiman Marcus, Advance Auto Parts, and LendingTree. Federal cases were consolidated in October 2024 into MDL No. 3126 before Judge Brian Morris in the District of Montana.13U.S. District Court, District of Montana. Snowflake Data Security Breach Litigation
Advance Auto Parts received final settlement approval on October 23, 2025, and Neiman Marcus obtained preliminary approval in May 2025. Claims against Snowflake itself were dismissed with prejudice in both of those tracks in December 2025. Litigation remains active against AT&T, Ticketmaster/Live Nation, Cricket Wireless, and LendingTree.14CourtListener. In Re Snowflake, Inc., Data Security Breach Litigation
On the criminal side, Connor Moucka and John Binns were indicted in October 2024 in the Western District of Washington on wire fraud, computer fraud, aggravated identity theft, and related conspiracy counts.15U.S. Department of Justice. United States vs. Connor Riley Moucka and John Erin Binns Prosecutors allege the pair extracted roughly 50 billion phone call and text records from AT&T alone and extorted at least $2.5 million in Bitcoin from three victims, including $370,000 from AT&T.16Mashable. Hackers Snowflake AT&T Ticketmaster Data Breach Indicted Moucka was extradited from Canada, pleaded not guilty at his July 2025 arraignment, and faces trial on October 19, 2026. Binns was detained in Turkey and is not in U.S. custody.
State Attorneys General Are Driving the New Wave
A 2026 litigation trends survey found 82% of corporate respondents reporting increased state enforcement activity, and the first half of 2026 produced several marquee cases.
California v. 23andMe
Attorney General Rob Bonta sued Chrome Holding Co., the corporate successor to 23andMe, on May 28, 2026, in San Francisco Superior Court over a 2023 breach exposing genetic and personal data of nearly 7 million users, including more than 855,000 Californians.17California Office of the Attorney General. Attorney General Bonta Sues Chrome Holding Co. Over 2023 Data Breach The complaint alleges the company failed to implement reasonable security, ignored known vulnerabilities including credential stuffing and a coding flaw in its “DNA Relatives” feature, and misled consumers about the breach’s severity while quietly paying a ransom.18Los Angeles Times. California Attorney General Sues 23andMe for Data Breach The state cites violations of the California Genetic Information Privacy Act, the Consumer Privacy Act, and false advertising and unfair competition laws. A parallel challenge is pending in federal bankruptcy court over the sale of genetic data during 23andMe’s bankruptcy.19HIPAA Journal. California AG 23andMe Data Breach Lawsuit
Texas v. Meta and WhatsApp
Texas Attorney General Ken Paxton sued Meta and WhatsApp on May 21, 2026, alleging the messaging app’s end-to-end encryption claims are deceptive because Meta employees and contractors can view message content in unencrypted form.20Texas Attorney General. Attorney General Paxton Files Lawsuit Against Meta and WhatsApp Filed in the 71st Judicial District Court in Harrison County, the suit brings claims under the Texas Deceptive Trade Practices Act and seeks injunctive relief plus monetary penalties exceeding $250,000. The state cites findings from a Commerce Department special agent and a whistleblower complaint.21Texas Attorney General. WhatsApp Petition
Texas v. Netflix
Also in May 2026, Texas sued Netflix under the same consumer protection law, alleging the streamer misled consumers about privacy, data collection, and safety; used dark patterns to collect and monetize behavioral data; and shared user information with third parties.9Clark Hill. Right to Know, June 2026
Healthcare Enforcement
State AGs have continued targeting healthcare. Comstar LLC settled with Massachusetts and Connecticut for $515,000 in 2026 following a ransomware attack affecting over 585,000 people.22HIPAA Journal. HIPAA Enforcement by State Attorneys General A 2024 multistate action by New York, New Jersey, and Connecticut against Enzo Biochem produced a $4.5 million penalty over a breach affecting 2.4 million people, and California secured $6.75 million from Blackbaud over a ransomware incident involving 5.5 million records.
New Cases to Watch
Washington, D.C., law firm Wiley Rein LLP was hit with a proposed class action on May 22, 2026, after disclosing that attackers accessed its Microsoft 365 email accounts for about eleven months, from July 2024 through June 2025. The firm has said the intrusion may be tied to a group affiliated with the Chinese government.23Reuters. Law Firm Wiley Rein Hit With Class Action Over Data Breach Tied to Chinese Hackers Burkett v. Wiley Rein (No. 26-cv-1791, D.D.C.) alleges the firm failed to implement basic safeguards such as multifactor authentication, allowing the theft of names, addresses, Social Security numbers, and financial and medical information. Victim notifications began in March 2026.24Bloomberg Law. Wiley Rein Sued for Exposing Sensitive Info After Cyberattack
Class action litigation also continues against Kettering Health over a May 2025 ransomware attack by the “Interlock” group that forced systems offline and exposed patient data. Multiple suits filed between May and July 2025 are being consolidated, with the case in early class certification and discovery. No settlement has been reached.25LawFold. Kettering Cyberattack Class Action Lawsuit26ClassAction.org. Acadia Healthcare Company May 202627ClassAction.org. Data Breach Lawsuits
Federal Enforcement by the SEC and FTC
The SEC’s cybersecurity disclosure rules, fully effective in late 2023 and 2024, require public companies to report material cyber incidents on Form 8-K within four business days and to disclose cybersecurity risk management and governance in annual 10-K filings.28SEC. Cybersecurity In December 2024, Flagstar Financial paid $3.55 million to settle allegations it made misleading disclosures about a 2021 breach, describing it as unauthorized “access” while concealing that data had been encrypted, systems disrupted, and 1.5 million individuals’ information exfiltrated. R.R. Donnelley & Sons paid $2.1 million in June 2024 over similar disclosure control failures. In the SolarWinds case, a federal judge in the Southern District of New York dismissed most of the SEC’s claims in July 2024 but allowed one to proceed, finding SolarWinds may have misrepresented its internal access controls in a public “Security Statement.”29Cleary Gottlieb. Cybersecurity Disclosure and Enforcement Developments and Predictions
The FTC has brought more than 90 cybersecurity enforcement actions since 2023.30FTC. Privacy and Security Enforcement Recent actions include a $10 million settlement with Disney over the unlawful collection of children’s data (approved December 2025), a $7.5 million action against education technology provider Illuminate Education, and a $930,000 settlement in May 2026 with Cox Media Group, MindSift, and 1010 Digital Works over deceptive marketing of an “Active Listening” AI service that the FTC said never actually used smart device voice data as claimed.9Clark Hill. Right to Know, June 2026 The agency has signaled it may pursue “algorithmic disgorgement,” requiring companies to delete not just improperly collected data but also the AI models built from it.
Why Filings Keep Climbing, and Why Many Still Get Dismissed
Data breach class action filings exceeded 1,800 in 2025, more than 25% growth over 2024 and more than 200% growth since 2022. Privacy class action complaints more broadly topped 3,000 filings in 2025, and cybersecurity and data privacy class actions now account for 40% of all class action activity, up from 32% in 2024.31IAPP. Understanding Emerging Digital Litigation Trends in the US32Norton Rose Fulbright. 2026 Annual Litigation Trends Survey
Plaintiffs’ firms are increasingly targeting third-party technology vendors, where a single vendor breach spawns suits across dozens of client organizations, as happened with Snowflake. Older statutes like the Video Privacy Protection Act and the Electronic Communications Privacy Act are being applied to modern tracking pixels and AI training data. Class action complaints are often filed before the breached organization even finishes its incident response.
Courts have not made it easy for plaintiffs. Article III standing remains a persistent obstacle, with federal circuits split on whether mere exposure to a breach, without proof the stolen data was actually misused, is enough to sue. The Supreme Court’s decisions in Spokeo v. Robins (2016) and TransUnion v. Ramirez (2021) established that an increased risk of future harm alone is generally insufficient to confer standing for damages. In practice, courts tend to require plaintiffs to show their data was acquired by an unauthorized party and subsequently misused in a way traceable to the breach. Allegations based solely on the fear of future identity theft are frequently dismissed. Motions to dismiss are being granted at increasing rates, which pushes many defendants toward pre-ruling settlements rather than fighting through class certification.