Most people who file a data breach claim through a class action receive between $25 and $300, while individuals who can document real financial losses from identity theft or fraud sometimes recover thousands more. How much a data breach claim is worth comes down to three things: what was stolen, what it actually cost you, and whether you’re one of millions splitting a settlement fund or pursuing your own case.
Typical Class Action Payouts
The headline numbers in big breach settlements rarely match what claimants take home. The Equifax breach exposed personal information for 147 million people and included up to $425 million in consumer relief, but claimants who chose the cash option of up to $125 saw that amount substantially reduced because of the volume of claims filed.1Federal Trade Commission. Equifax Data Breach Settlement The T-Mobile settlement offered a $25 alternative cash payment to most class members, or $100 for California residents, with both amounts subject to pro rata reduction depending on how many people filed.2T-Mobile Data Breach Settlement. Frequently Asked Questions
Those figures climb sharply when you can prove the breach cost you something specific. The T-Mobile settlement allowed up to $25,000 in reimbursement for out-of-pocket losses traceable to the breach, plus $25 per hour for time spent dealing with fraud or identity theft.2T-Mobile Data Breach Settlement. Frequently Asked Questions Other settlements use tiered structures. One healthcare breach, for example, paid up to $300 for standard claims and up to $3,000 for extraordinary losses. The gap between “I got a breach notification” and “I can document what the breach did to me” is where claim value is really determined.
What You Can Actually Claim
Direct Financial Losses
Out-of-pocket costs tied to the breach are the easiest category to recover. Fraudulent charges on credit cards, unauthorized bank withdrawals, replacing stolen funds, credit monitoring subscriptions you paid for, identity theft protection services, fees for replacing government IDs, and costs for new account numbers all count. Receipts and bank statements make these claims straightforward.
Time Spent on Cleanup
Settlement administrators increasingly treat your time as compensable. Hours on the phone with banks, filing police reports, freezing credit, and watching accounts for suspicious activity typically pay a fixed hourly rate of around $20 to $25. Some settlements reimburse at your documented wage rate if you took time off work. A written log of every call and how long it took is the kind of record that gets these claims paid.
Emotional Distress
Anxiety and stress from knowing your information is in the wrong hands can form part of a claim, but courts are cautious. The Supreme Court suggested in TransUnion LLC v. Ramirez that emotional distress from a risk of future harm might qualify as a concrete injury but left the question open.3Congressional Research Service. A General Principle of Article III Standing Lower courts remain split. These claims are strongest when backed by medical records, therapy bills, or a documented diagnosis rather than general assertions of worry.
Future Risk of Identity Theft
Even when no fraud has happened yet, the exposure of permanent identifiers like Social Security numbers or biometric data creates a long-term risk some courts recognize. In practice, the value of this category usually shows up as reimbursement for credit monitoring and identity protection services rather than a large standalone award.
Statutory Damages Set a Floor
Some federal laws let you recover a fixed amount per violation without proving a specific dollar loss. Under the Fair Credit Reporting Act, a company that willfully violates its obligations owes between $100 and $1,000 per violation in statutory damages, plus potential punitive damages and attorney fees.4Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance “Willful” covers reckless disregard for the law, not just intentional misconduct. Courts set the award within that range based on the severity and frequency of violations.
Several states have their own privacy laws with private rights of action and their own statutory damage ranges. If a company stored your data in a state with strong privacy legislation, you may have additional avenues beyond federal law. Statutory damages matter most when your actual losses are small or hard to prove; they give you a floor, not a ceiling, and you can still pursue actual damages if they exceed the statutory amount.
When Punitive Damages Enter the Picture
Courts can add punitive damages on top of compensatory amounts when a company’s conduct was especially reckless. Ignoring known security vulnerabilities, concealing a breach from affected individuals, or storing sensitive data with essentially no protections at all are the kinds of facts that support them. Punitive damages are rarely part of class action settlements. They are more realistic in individual lawsuits where you can show conduct that went beyond ordinary negligence into something closer to deliberate indifference.
What Pushes a Claim Higher or Lower
The type of data stolen is the single biggest factor. A breach exposing Social Security numbers, financial credentials, or medical records creates far more fraud potential than one leaking email addresses, and courts treat permanent identifiers that cannot be changed as carrying higher inherent risk.
The company’s conduct matters almost as much. A business that ignored repeated warnings, skipped basic encryption, or delayed notifying affected individuals faces stronger claims than one that maintained reasonable safeguards and got hit by a sophisticated attack. The clearer the failure, the easier it is to establish liability.
Your personal harm fills in the rest. Someone who spent 40 hours and $2,000 cleaning up fraudulent accounts opened in their name has a very different claim than someone who got a notification and signed up for free credit monitoring. The connection between the breach and your losses needs to be traceable, which means documenting everything as you go.
Class Action or Your Own Lawsuit?
Most data breach claims land in class actions because millions of people are affected by the same incident and individual stakes are too small to justify separate suits. The upside is that you don’t need to hire an attorney or invest personal time. The downside is modest per-person payouts that shrink further when a large percentage of the class files against a fixed fund. Major breach class actions routinely take two to four years to resolve, and distribution can stretch beyond that.
Filing your own case makes sense when your documented losses significantly exceed what a class action would pay. Extensive identity theft, substantial money lost to fraud, or serious emotional harm with medical documentation can support a tailored recovery that reflects your actual damages. The tradeoffs are time, effort, and litigation costs. Many individual cases settle before trial, especially when the evidence of negligence is strong and the damages are clear, because a company would rather settle than risk a verdict that includes punitive damages.
What Comes Out Before You Get Paid
Attorney Fees
In class action settlements, attorney fees come out of the fund before class members get checks. Courts commonly approve fees of 25% to 33% of the total fund, though the percentage varies by circuit and case complexity. A $100 million settlement may have $25 million or more going to legal fees before anything reaches claimants.
For individual lawsuits, data breach attorneys handling cases on contingency typically charge 33% to 40% of any recovery. Under certain federal statutes like the FCRA, a prevailing plaintiff can recover attorney fees from the defendant on top of damages, which means the fee does not come out of your award.4Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance Fee-shifting depends on which law your claim is brought under and whether you win.
Taxes on Your Settlement
Different parts of a data breach settlement are taxed differently. Reimbursement for actual financial losses, like money stolen through fraud or out-of-pocket expenses, is generally not taxable because it restores you to where you were rather than creating new income. Compensation for emotional distress that does not stem from a physical injury or physical sickness is taxable, and since data breach claims almost never involve physical injury, those payments are typically taxed. Punitive damages are always taxable and get reported as other income on Schedule 1 of Form 1040.5Internal Revenue Service. Settlement Income (Publication 4345)
Free identity protection services from a breached company, including credit monitoring, identity theft insurance, and identity restoration services, are not treated as taxable income by the IRS.6Internal Revenue Service. Announcement 2015-22 That exclusion does not extend to cash you take instead of those services.
What to Do Now to Protect the Value of Your Claim
The steps you take right after learning about a breach limit your financial exposure and build the documentation trail that makes or breaks a later claim. Save every notification the company sends, every letter you mail, every call log, and every receipt for breach-related expenses. If you spend time resolving fraudulent activity, write down the date, the task, and how long it took. This contemporaneous log is exactly what settlement administrators and courts look for when evaluating claims for lost time.
Monitor your bank accounts, credit card statements, and credit reports closely for at least 12 months, and report unauthorized transactions as soon as you see them. Consult an attorney if your losses are significant or if the breach involved highly sensitive data. Most data breach attorneys offer free initial consultations and work on contingency, so the upfront cost is usually zero, and an attorney can tell you whether opting out of a class action and filing your own claim is likely to pay more than staying in.