Class Action Lawsuit Data Breach Settlements List (2026)

Looking for a class action lawsuit data breach victims can still file a claim in? As of September 29, 2026, none of the data breach settlements we track is open for claims. The three cases on our list, 23andMe, AT&T, and Nelnet, have all passed their deadlines, and people who filed on time are still waiting to be paid. Security incidents produce new settlements faster than any other category, so this list is updated as new ones open.

A data breach class action is a lawsuit filed on behalf of everyone whose personal information was exposed in the same security incident. If it settles, a court-appointed settlement administrator runs a claim website, and each class member who files gets cash, credit monitoring, or both. The table below shows every case in this category from our records, open ones first, then pending, then closed.

What’s on Our Data Breach Settlement List Right Now

The list has three cases, and all three are closed to new claims with payments still pending. When we reviewed every record on this site on September 29, 2026, this is where each one stood:

23andMe (2023 hack of 6.9 million profiles). Claims closed February 17, 2026. The bankruptcy court approved a $46.75 million fund on July 7, 2026, but no payment date has been announced.
AT&T (two 2024 incidents, $177 million). Claims closed December 18, 2025. The court still hadn’t granted final approval, so nobody has been paid.
Nelnet Servicing (2022 student loan hack, $10 million). Claims closed March 5, 2026. Final approval came May 21, 2026; the payment date hasn’t been posted.

Older cases are finished. The T-Mobile 2021 deal ($350 million) and the Capital One 2019 deal ($190 million) have paid out, and the 2015 hack of T-Mobile applicant records held by Experian closed to claims in 2019. On the other end, a proposed class action against DoorDash over a 2025 social engineering attack (Andrizzi v. DoorDash, filed November 18, 2025) has no settlement yet. Open data breach settlements appear at the top of the table the day we add them.

How Data Breach Class Actions Work

Most of these suits allege negligence: the company held your personal information and failed to use reasonable data security to protect it. Complaints usually add breach of implied contract and state privacy or consumer protection claims. Suits often follow within days of the notice letters. In the Nelnet case, notices went out August 26, 2022, and the first of 23 proposed class complaints was filed four days later.

Every state, plus the District of Columbia, Guam, Puerto Rico, and the Virgin Islands, has a law requiring businesses to notify people when certain personal information is breached, according to the National Conference of State Legislatures. The notice defines who’s affected, and the class definition in a later settlement usually tracks it closely.

Standing is the hurdle that shapes payouts. In TransUnion LLC v. Ramirez (2021), the U.S. Supreme Court held that each class member needs a concrete injury to recover damages, and that a risk of future harm alone isn’t enough in a damages case. That’s why settlements pay more to people who can document losses and less, often a small flat amount, to everyone else. State law changes the math too. California’s privacy law sets statutory damages of $100 to $750 per consumer per incident for certain security failures, which is why California residents often get a larger share: $100 instead of $25 in the T-Mobile case, and double the base cash payment in Nelnet.

What Breach Settlements Pay: 4 Benefit Types

Nearly every one of these deals offers some mix of four benefits. You usually pick between a documented claim and a flat cash payment, and credit monitoring comes on top.

Benefit	What you need	Real examples from our records
Out-of-pocket losses	Receipts, bank statements, or fraud reports	Up to $25,000 (Capital One, T-Mobile); up to $10,000 (23andMe); up to $5,000 per incident (AT&T)
Lost time	A short statement, sometimes receipts	Up to 15 hours at $25 an hour (Capital One); up to 4 hours at $25 an hour (Nelnet)
Flat or pro rata cash	Usually nothing beyond the claim form	$25, or $100 in California (T-Mobile); about $100 statutory payment (23andMe); pro rata shares (AT&T, Nelnet)
Credit monitoring or identity restoration	Enroll with the code you receive	2 years (Nelnet); 5 years (23andMe); identity restoration for Capital One class members until February 13, 2028

Pro rata means “a share of what’s left.” The administrator pays fees, administration costs, and documented loss claims first, then divides the remainder by the number of valid cash claims. More claimants means a smaller check. A detail that’s easy to miss: restoration services often outlive the cash. Capital One’s program stays open to every class member, even people who never filed, until 2028.

Got a Breach Notice? What to Do Before Any Settlement Exists

Protect your credit now and keep your paperwork, because a payout can take years to arrive. T-Mobile’s 2021 settlement finished paying in 2025. These steps cost nothing:

Freeze your credit at Equifax, Experian, and TransUnion. The Federal Trade Commission says a freeze is free to place and lift and doesn’t affect your credit score. It blocks most new-account identity theft.
Keep the notice letter or email. It proves you’re in the affected group, and some claim forms ask for the code printed on it.
Log your time and costs. Write down hours spent on fraud calls and save receipts for any fees. Documented losses pay far more than flat cash.
Report actual fraud at IdentityTheft.gov. The FTC’s site builds a recovery plan and an identity theft report you can use with banks and creditors.
Watch for the settlement. If a case settles, you’ll typically get a second notice by email or mail. Our upcoming claim deadlines page tracks dates, and our guide on how to join a class action covers filing.

How to Tell a Real Breach Settlement Site From a Scam

A real settlement website names the case, the court, and the case number, and it never charges you to file. Hack victims are prime targets for fake claim pages, since scammers know you’re expecting an email about your stolen information. Check these before you type anything:

The site matches the one named in the court-approved notice, such as NelnetSettlement.com for the Nelnet case.
It asks for your notice ID or contact details, not your full Social Security number, bank login, or card PIN.
It lists a toll-free number and a mailing address for the administrator (firms such as Kroll or A.B. Data).
Its deadline matches what the court docket or a government source shows.

We only link to administrator sites that name the case, which is why every claim link in the table goes to the official settlement site rather than a law firm intake form.

Where the FTC and State Attorneys General Fit In

Government agencies bring their own cases, separate from private class actions. The biggest example is Equifax: after the 2017 hack exposed information on 147 million people, the FTC, the Consumer Financial Protection Bureau, and 50 states and territories reached a settlement that includes up to $425 million to help affected people. Its claim deadline was January 22, 2024, and free identity restoration runs through January 2029, per the FTC’s Equifax settlement page.

State attorneys general also collect breach notices. California’s attorney general publishes a searchable list of incidents reported to the state, which is a quick way to confirm that a letter you received matches a real incident. Many AG cases end in fines or security commitments rather than money for individual consumers, so they don’t always show up on a settlement list.

Your next step: freeze your credit if you haven’t, save every notice letter in one folder, and bookmark this page. The moment a new class action lawsuit data breach victims can file in opens, it goes to the top of the table with its deadline and official claim link.

Data Breach Class Action FAQ

How much compensation will I get for a data breach?

Most people who file without receipts get a small cash payment, often $25 to $100. Claimants with documented out-of-pocket losses can recover much more, up to $25,000 in the largest settlements. Pro rata payments shrink as more people file.

How do I find out if I am part of a class action settlement?

You’re usually a class member if you received the company’s breach notice. The settlement website lists the exact class definition, and many let you look up your notice ID. If you got no notice, contact the administrator before the deadline.

How do I find out if my data was breached?

Companies must mail or email a notice under state notification laws, so check your mail and inbox first. California’s attorney general and other state AGs publish lists of reported incidents. If you see fraud, report it at IdentityTheft.gov.

Can I still file a claim after the deadline passes?

No. Once the claim deadline passes, late claims are generally rejected, and if you didn’t opt out, the settlement’s release still bars you from suing on your own. Some benefits, such as identity protection services, can stay available to all class members for years.

Do I need a lawyer to file a data breach claim?

No. Class counsel already represents every class member, and their fees come out of the settlement fund. Filing a claim on the official site is free.

This page explains how these settlements generally work. It isn’t legal advice. For advice about your own situation, talk to a licensed attorney.

Data Breach Class Action Lawsuits and Settlements