Data Breach Settlement: Largest Payouts and How to File a Claim

A data breach settlement is a court-approved agreement, almost always ending a class action lawsuit, in which a company that exposed consumers’ personal information pays into a fund that compensates the people affected. If your data was in a breach covered by one of these settlements, you are usually eligible for either a small flat cash payment or a larger reimbursement if you can document financial harm. You generally have to file a claim by a deadline to get anything.

Settlements You May Still Be Able to Claim or Track

23andMe

The 23andMe settlement covers roughly 6.4 million U.S. customers whose data was exposed in a 2023 credential-stuffing attack.¹ The case became unusual when the company filed for Chapter 11 bankruptcy in March 2025 and was bought for $305 million by a nonprofit led by former CEO Anne Wojcicki. The business was renamed ChromeCo, Inc., and the settlement is now being administered through the U.S. Bankruptcy Court for the Eastern District of Missouri.²

The fund ranges from $30 million to $50 million. Extraordinary claims for documented identity theft or related costs are capped at $10,000 per person, under a subtotal cap of $8.3 million. Residents of Alaska, California, Illinois, or Oregon can receive an estimated $100 statutory payment. All class members get five years of privacy and genetic monitoring.² The court granted final approval on January 30, 2026, but payments are on hold while the bankruptcy reconciliation plays out, which the court said could take several months or longer.³

AT&T

AT&T agreed to a combined $177 million settlement covering two separate 2024 breaches. The first, in the Northern District of Texas, covers a March 2024 incident and pays up to $5,000 per person. The second, part of the Snowflake data breach litigation in the District of Montana, pays up to $2,500 per person. People affected by both can claim up to $7,500.⁴⁵ Kroll is the settlement administrator. As of mid-2026, the deal is still awaiting final court approval and no payments have gone out.⁶

Kaiser Permanente

Kaiser Permanente agreed to pay between $46 million and $47.5 million over allegations that third-party tracking tools on its websites and mobile apps shared sensitive patient information with outside companies. The class covers roughly 13.1 to 13.4 million members in nine states and the District of Columbia who used authenticated Kaiser online services between November 2017 and May 2024.⁷ Because the class is so large, individual payouts are estimated at about $21 to $42, distributed as equal pro rata shares.⁸ The claim deadline was March 12, 2026, and the final approval hearing was scheduled for April 30, 2026.

Capital Health Systems

Capital Health agreed to a $4.5 million settlement over unauthorized access to patient data in November 2023, covering patients, former patients, and employees. Documented losses are reimbursable up to $5,000, with a $100 flat-payment alternative. The claim deadline passed in April 2026, and a final approval hearing is scheduled for July 14, 2026.⁹¹⁰

Harvard Pilgrim and Shields Health Care

Harvard Pilgrim Health Care’s $16 million settlement, consolidated in the District of Massachusetts, covers a 2023 ransomware attack affecting nearly 3 million people. Documented-loss claims go up to $35,000. The settlement is awaiting final approval.¹¹

Shields Health Care’s $15.35 million settlement covers about 2.38 million patients whose medical and personal data was accessed during a March 2022 cyberattack. Class members can claim up to $25,000 for extraordinary losses or a flat $50 with no documentation. The case is pending preliminary court approval.¹²

MGM Resorts

MGM Resorts agreed to pay $45 million to resolve claims from data breaches in 2019 and 2023. The consolidated case was heard in the U.S. District Court for the District of Nevada before Judge Gloria M. Navarro, and class members could claim up to $15,000.¹³ The court granted final approval on June 18, 2025, and the settlement is in the payment-processing phase. Any unclaimed funds will be donated to the UNLV Cyber Clinic.¹⁴

Lehigh Valley Health Network

LVHN settled for $65 million after a February 2023 ransomware attack by the Russian group BlackCat. The breach drew particular attention because the attackers stole and published medical records and nude photographs of cancer patients, affecting more than 134,000 people.¹⁵ Payments ranged from $50 to $80,000 depending on severity of exposure, with the lead plaintiff receiving $125,000. The Lackawanna County, Pennsylvania court granted final approval in November 2024. Initial checks went out in March 2025, and supplemental payments for one tier were mailed in April 2026.¹⁶

Equifax

The Equifax settlement, resolving a 2017 breach that exposed data on roughly 147 million Americans, remains the benchmark U.S. case. Approved in January 2020 in the Northern District of Georgia, it created a consumer restitution fund of at least $380.5 million, with up to another $125 million if that fund was exhausted.¹⁷ The administrator distributed final payments between November and December 2024 from about $70 million in remaining funds.¹⁸ In August 2025, additional funds were loaded onto existing prepaid cards for some claimants.¹⁹ The deadline to file new claims passed in January 2024.

T-Mobile and Yahoo

T-Mobile’s $350 million settlement covered about 76 million people hit by the August 2021 cyberattack, with up to $25,000 for documented losses or a flat $25 ($100 for California residents).²⁰²¹

Yahoo’s $117.5 million settlement in the Northern District of California covered breaches from 2013 through 2016 affecting billions of accounts. Distribution began in June 2023, with up to $25,000 in documented losses or an alternative cash payment that varied from under $100 to a maximum of $358.80 depending on how many people filed. The administrator is still finalizing payments.²²

What You Actually Get Paid

Most class members who file a no-documentation claim receive a small amount, typically between $25 and $150.²³ Equifax showed how far that can shrink: the fund initially allowed up to $125 for people who chose cash over credit monitoring, but so many people filed that the actual payout came out to only a few dollars for most recipients.¹⁹

Documented harm pays substantially more. Depending on the settlement, documented-loss claims can reach $5,000, $20,000, or $25,000 per person. Time spent dealing with the breach is often reimbursable at $25 to $30 per hour.¹⁷²² Many settlements also include free credit monitoring for two to ten years.

The gap between the headline number and your check comes from simple math. A $350 million fund split among 76 million people is less than $5 a head before anything else. Attorneys’ fees take a cut; in the Capital Health case, class counsel asked for up to a third of the $4.5 million fund.²⁴ Administrative costs, service awards for named plaintiffs, and set-asides for credit monitoring further reduce what reaches individual claimants. Documented-loss claims also consume a larger share of the fund per person, which pulls down the flat-payment pool.

How to File a Claim

Being in a settlement class does not mean a check arrives on its own. Payment almost always requires filing a claim.

Notice usually arrives by email or postal mail once a settlement is reached or a class is certified. Companies that hold customer records can often identify who was affected, and settlement administrators publish dedicated case websites with claim forms.
Claims are typically submitted through an online form. Some settlements offer a flat payment with no proof required; others reimburse documented out-of-pocket losses at higher amounts, and many offer both.
A court-appointed settlement administrator reviews claims, flags deficient submissions, and calculates payouts. Payments go out after final court approval, usually by check, prepaid card, or electronic deposit.²⁵

Deadlines are strict and set by court order. Missing the filing date almost always forfeits any right to compensation, even if you were clearly affected. Most data breach class actions take two to five years to resolve, so by the time notice reaches you, the claim window may be short. These cases are usually “opt-out” class actions: if you fit the class definition, you are included automatically unless you file an opt-out form by the court’s deadline. Opting out preserves your right to sue on your own but gives up your share of the class settlement.²³

Largest Data Breach Settlements on Record

The biggest resolutions combine regulatory penalties with class action payouts, and several of the headline numbers do not translate into consumer checks.

Meta/Facebook, $1.4 billion (Texas, 2024): the state of Texas settled with Meta over biometric data captured through facial recognition, the largest privacy settlement obtained by a single U.S. state.²⁶
Meta/Facebook, $1.3 billion (EU, 2023): Ireland’s Data Protection Commission fined Meta €1.2 billion for unlawful transfers of EU user data to the United States under the GDPR. Meta said it will appeal.²⁷
Didi Global, $1.19 billion (China, 2022): the Cyberspace Administration of China fined Didi 8.026 billion yuan for network and data security violations. Didi accepted the decision.²⁷
Amazon, $877 million (EU, 2021): Luxembourg regulators fined Amazon €746 million for GDPR violations tied to behavioral advertising. Amazon has contested the fine.²⁷
Equifax, up to $700 million (U.S., 2019): settled with the FTC, CFPB, and all 50 states over its 2017 breach, with roughly $425 million for a consumer restitution fund.²⁸
TikTok, $600 million (EU, 2025): Ireland’s DPC fined TikTok €530 million over data transfers to China and misleading information. TikTok plans to appeal.²⁷
T-Mobile, $350 million (U.S., 2022): class action settlement over the 2021 breach affecting 76 million customers, with an additional $150 million committed to cybersecurity improvements.²⁷²⁹
AT&T, $177 million (U.S., 2025): $149 million for the March 2024 breach and $28 million for the Snowflake-linked breach, pending final approval.⁶
Anthem, $115 million: one of the largest healthcare data breach settlements in U.S. history.³⁰

Not Every Big Settlement Pays Consumers

Some high-profile data breach settlements go to government agencies, not to affected individuals. Marriott’s $52 million multistate settlement, reached in October 2024 with 49 states and the District of Columbia over security failures that let intruders access Starwood guest records from 2014 through 2018, compromising 131.5 million records, did not include direct payments to consumers.³¹ The money was paid to the states as penalties. The agreement does require Marriott to undergo independent security assessments every two years for 20 years, minimize data collection, and let customers request deletion of their stored personal information.³² Separately, the FTC required Marriott to restore loyalty points stolen by hackers and provide a way for consumers to request reviews of unauthorized account activity.³³ If you are looking for a check from a data breach case, confirm the settlement is a class action with a consumer claims process, not a regulator-only penalty.

1
HIPAA Journal. 23andMe Class Action Data Breach Settlement
2
23andMe Data Settlement. 23andMe Data Settlement FAQ
3
23andMe Data Settlement. 23andMe Data Settlement
4
Time. AT&T Data Breach Settlement: How To File a Claim
5
AT&T Settlement Agreement. AT&T Data Breach Settlement Agreement
6
ABC7. AT&T Data Breach $177 Million Settlement
7
HIPAA Journal. Kaiser Permanente Website Tracker Breach Affects 13.4 Million Individuals
8
ClassAction.org. Up to $47.5M Kaiser Settlement Ends Class Action Lawsuit
9
NJ.com. NJ Health System Agrees To Pay $4.5M in Data Breach Settlement
10
Capital Health Data Breach Settlement. Capital Health Data Breach Settlement
11
HIPAA Journal. Harvard Pilgrim Health Care Data Breach Settlement
12
Shields Data Settlement. Shields Health Care Data Breach Settlement FAQ
13
Stranch Law. Nevada District Court Approves Preliminary $45M MGM Data Breach Class Action Settlement
14
Morgan & Morgan. $45 Million Class Action Settlement Approved in MGM Resorts Data Breach Case
15
WHYY. Lehigh Valley Health Data Breach Settlement
16
LVHN Data Breach Settlement. Lehigh Valley Health Network Data Breach Settlement
17
Equifax Breach Settlement. Equifax Data Breach Settlement FAQ
18
Equifax. Equifax Statement on Final Payments in the Data Breach Settlement
19
Nolo. Equifax Data Breach Settlement: How To Get Compensation
20
T-Mobile Settlement. T-Mobile Data Breach Settlement FAQ
21
T-Mobile Settlement. T-Mobile Data Breach Settlement
22
Yahoo Data Breach Settlement. Yahoo! Inc. Customer Data Security Breach Litigation
23
The Simon Law Group. Data Breach Class Action Lawsuit
24
ClassAction.org. Capital Health Data Breach Settlement Long Notice
25
Kroll. Data Breach and Privacy Settlement Administration
26
RedFoxSec. Data Breach Tracker 2026: Latest Breaches & Settlements
27
CSO Online. The Biggest Data Breach Fines, Penalties, and Settlements So Far
28
Equifax. Equifax Data Breach Settlement FAQ
29
Keller Rohrback LLP. T-Mobile 2021 Data Breach
30
Healthcare Dive. Anthem To Pay Record $115M To Settle Data Breach Lawsuit
31
New York Attorney General. Attorney General James Announces $52 Million Multistate Settlement With Marriott
32
Iowa Attorney General. Attorney General Bird Announces $52 Million Multistate Settlement With Marriott
33
FTC. FTC Takes Action Against Marriott and Starwood Over Multiple Data Breaches