Looking for a class action lawsuit data breach victims can still file a claim in? As of October 31, 2026, five of the 11 data breach settlements on this list are open, and each one has a cash option that needs no receipts. The soonest deadline is November 2, 2026, in the ConnectOnCall case. The other six, including 23andMe, AT&T, and Nelnet, are closed to new claims.
A data breach class action is a lawsuit filed on behalf of everyone whose personal information was exposed in the same security incident. In a class action settlement, a court-appointed settlement administrator runs a claim website, and each class member who submits a claim gets cash, monitoring, or both. The table below shows every case in this category, active ones first.
| Company | Status | Claim deadline | Estimated payout | Proof required | How to file |
|---|---|---|---|---|---|
| Laboratory Services Cooperative (Planned Parenthood lab provider) | Open | Nov 24, 2026 | Pro rata cash fund payment of up to $1,000, available to all class members with no documents needed; or up to $5,000 for documented losses; plus two years of credit monitoring and medical shield | No | File a claim |
| Kelly Benefits (Kelly & Associates Insurance Group) | Open | Dec 28, 2026 | Pro rata cash payment estimated at $50, no documents needed; or up to $5,000 for documented losses; plus an estimated $100 California statutory payment for eligible California residents and three years of credit monitoring | No | File a claim |
| AT&T | Closed | Dec 18, 2025 | Claims closed. Up to $5,000 in documented losses for the March 2024 breach and up to $2,500 for the July 2024 breach (up to $7,500 combined), or a pro rata cash payment instead. Final amounts not set; no payments until final court approval | No | Not accepting claims |
| 23andMe | Closed | Feb 17, 2026 | Claims closed. About $100 statutory payment (Alaska, California, Illinois, Oregon residents), about $165 for health information claims, up to $10,000 for documented extraordinary losses, plus 5 years of Privacy and Medical Shield with Genetic Monitoring. $46.75 million fund approved July 7, 2026; payment date not announced | No | Not accepting claims |
| Nelnet Servicing | Closed | Mar 5, 2026 | Claims closed. Final approval granted May 21, 2026; payment date not yet announced. Choice of documented losses up to $5,000 plus up to 4 hours of lost time at $25 an hour (receipts needed), or a pro rata cash share with no proof (2x for California residents), plus 2 years of credit monitoring | No | Not accepting claims |
| Doxim | Closed | Oct 13, 2026 | Pro rata cash payment estimated at $100, no documents needed; or up to $5,000 for documented losses; plus one year of credit monitoring | No | Not accepting claims |
| Lands' End | Closed | Oct 22, 2026 | One-time alternate cash payment expected to be $60, no documents needed; or up to $5,000 for documented out-of-pocket losses; plus two years of credit monitoring for all class members | No | Not accepting claims |
| FinWise Bank | Closed | Oct 29, 2026 | Pro rata cash payment, amount depends on claims filed, no documents needed (California residents may receive up to double); or up to $5,000 for documented losses; plus two years of credit monitoring | No | Not accepting claims |
| ConnectOnCall | Closed | Nov 2, 2026 | Pro rata cash payment of up to $75, no documents needed; or up to $5,000 for documented losses | No | Not accepting claims |
| Summit Medical Group | Closed | Nov 4, 2026 | Lost time payment of $15 per hour for up to 3 hours (maximum $45) with a signed attestation, no receipts needed; or up to $2,500 for documented losses; plus two years of medical data monitoring. Cash may be reduced pro rata if claims exceed $500,000 | No | Not accepting claims |
| American Vision Partners | Closed | Nov 12, 2026 | Pro rata cash payment, amount depends on claims filed, no documents needed; or up to $3,000 for documented losses | No | Not accepting claims |
Open Breach Settlements, Soonest Deadline First
These five are taking claims. In each, you pick a no-proof cash payment or a larger documented loss claim, not both. The no-proof settlement list covers that kind of claim across every industry.
- ConnectOnCall (deadline November 2). A pro rata payment of up to $75 with no documents, or up to $5,000 for documented losses.
- Summit Medical Group (deadline November 4). $15 an hour for up to 3 hours of lost time ($45 maximum) with a signed attestation and no receipts, or up to $2,500 for documented losses, plus two years of medical data monitoring. Cash may be reduced pro rata if claims exceed $500,000.
- American Vision Partners (deadline November 12). A pro rata share of a $1.75 million fund with no documents, or up to $3,000 for documented losses.
- Laboratory Services Cooperative, a Planned Parenthood lab provider (deadline November 24). A pro rata payment of up to $1,000 with no documents, or up to $5,000 for documented losses, plus two years of credit monitoring and medical shield.
- Kelly Benefits, also known as Kelly & Associates Insurance Group (deadline December 28). A pro rata payment estimated at $50, or up to $5,000 for documented losses, plus an estimated $100 for eligible California residents and three years of identity monitoring.
File online if you can; a paper form only counts if it’s postmarked by the deadline. The deadlines to opt out of the settlement in ConnectOnCall, Summit Medical Group, and American Vision Partners have already passed, so class members there who don’t file get nothing and still give up the right to sue on their own. No cash figure is final until the settlement becomes final, meaning the court approves the proposed settlement and the appeal window closes.
Closed Cases: Who Has Been Paid and Who Is Still Waiting
Six cases no longer accept claims. Late forms are generally rejected, but each settlement class member who filed on time stays in line for payment:
- FinWise Bank. Closed October 29, 2026. Filers chose a pro rata cash share or up to $5,000 for documented losses.
- Lands’ End. Closed October 22, 2026. It offered an expected $60 no-documents payment or up to $5,000 for out-of-pocket losses.
- Doxim (In re Doxim, Inc. Data Security Incident Litigation). Closed October 13, 2026, ending the estimated $100 no-documents payment.
- AT&T (two 2024 incidents, $177 million). Closed December 18, 2025. A federal judge granted final approval in October 2026, news reports said, and the deal calls for payment within 60 days of its effective date, which follows any appeals.
- 23andMe (2023 hack of 6.9 million profiles). Closed February 17, 2026. The bankruptcy court approved a $46.75 million fund on July 7, 2026, and the administrator reports that approved claims were paid September 29 and 30, 2026. Still waiting? Contact the 23andMe administrator directly and ignore any email that asks for a fee.
- Nelnet Servicing (2022 student loan hack, $10 million). Closed March 5, 2026. Final approval came May 21, 2026; the administrator site hasn’t posted a payment date.
Older cases are finished. The T-Mobile 2021 deal ($350 million) and the Capital One 2019 deal ($190 million) have paid out, and the 2015 hack of T-Mobile applicant records held by Experian closed to claims in 2019. Equifax is the largest: after its 2017 hack exposed 147 million people, the Federal Trade Commission (the federal consumer protection agency), the Consumer Financial Protection Bureau, and 50 states and territories reached a settlement worth up to $425 million. Its claim deadline was January 22, 2024, but free identity restoration runs until January 2029, per the FTC’s Equifax settlement page. On the other end, a proposed class action against DoorDash over a 2025 social engineering attack (Andrizzi v. DoorDash, filed November 18, 2025) has no deal yet. For why these cases drag on, see how long class actions take.
Why Most Breach Payouts Are Small
Payouts stay small because courts award damages only for concrete, provable harm. Many data breach suits are filed in federal court, and most allege negligence: the company held your personally identifiable information and failed to use adequate data security measures to stop unauthorized access. Complaints usually add breach of implied contract and state consumer protection claims, and they arrive fast. In Nelnet, notices went out August 26, 2022, and the first of 23 proposed class complaints was filed four days later.
Every state, plus the District of Columbia, Guam, Puerto Rico, and the Virgin Islands, requires businesses to notify people when certain personal information is exposed, according to the National Conference of State Legislatures. That notice usually decides who lands in the settlement class.
Standing is the hurdle. In TransUnion LLC v. Ramirez (2021), the U.S. Supreme Court held that each class member needs a concrete injury to recover damages, and a risk of future harm alone isn’t enough. So settlements pay more to people who can document losses and a small flat amount to everyone else. California raises the floor. Its privacy law sets statutory damages of $100 to $750 per consumer per incident for certain security failures, which is why Californians got $100 instead of $25 in T-Mobile and double the base cash in Nelnet.
What Each Benefit Type Asks You to Prove
Nearly every deal mixes four settlement benefits. You usually choose between a documented claim and flat cash, and monitoring comes on top.
| Benefit | What you need | Examples from past cases |
|---|---|---|
| Out-of-pocket losses | Receipts, bank statements, or fraud reports | Up to $25,000 (Capital One, T-Mobile); up to $10,000 (23andMe); up to $5,000 per incident (AT&T) |
| Lost time | A short statement, sometimes receipts | Up to 15 hours at $25 an hour (Capital One); up to 4 hours at $25 an hour (Nelnet) |
| Flat or pro rata cash | Usually nothing beyond the claim form | $25, or $100 in California (T-Mobile); about $100 statutory payment (23andMe); pro rata shares (AT&T, Nelnet) |
| Monitoring or identity restoration | Enroll with the code you receive | 2 years (Nelnet); 5 years (23andMe); identity restoration for Capital One class members until February 13, 2028 |
Pro rata means “a share of what’s left.” The administrator pays attorneys’ fees, service awards for the named plaintiffs, administration costs, and documented loss claims first, then splits the remainder among valid cash claims. More claimants, smaller checks. Restoration services often outlive the cash: Capital One’s program remains available to every class member, even people who never filed, until 2028. For tax treatment of a payout, see whether settlements are taxable.
Got a Breach Notice? 5 Steps Before Any Settlement Exists
The steps that help most following a data breach cost nothing, and they matter because a payout can take years. T-Mobile’s 2021 settlement finished paying in 2025.
- Freeze your credit reports at Equifax, Experian, and TransUnion. The Federal Trade Commission says a freeze is free to place and lift and doesn’t affect your credit score. It blocks most new-account identity theft.
- Keep the notice letter or email. It proves you’re in the affected group, and some claim forms ask for the code printed on it.
- Log your time and costs. Write down hours on fraud calls and money spent fixing the damage, and save receipts for out-of-pocket costs. Documented claims receive reimbursement up to the cap, which beats flat cash.
- Report actual fraud at IdentityTheft.gov. If a financial account is misused, the FTC’s site builds a recovery plan and a report you can hand to banks and creditors.
- Watch for the settlement. A second notice usually arrives by email or mail. The upcoming claim deadlines page tracks dates, and the guide on how to join a class action covers filing.
How to Spot a Fake Settlement Claim Site
A real settlement website names the case, the court, and the case number, and it never charges a fee. Scammers target hack victims because they know you’re waiting on news about your sensitive personal information. Before typing anything, confirm that:
- The site matches the one named in the court-approved notice, such as NelnetSettlement.com for the Nelnet case.
- It asks for your notice ID or contact details, never your full Social Security number, bank login, or card PIN.
- It shows a toll-free number and mailing address for the administrator (firms such as Kroll or A.B. Data).
- Its deadline matches the court docket or a government source.
Your next step: if you got a notice from ConnectOnCall, Summit Medical Group, American Vision Partners, Laboratory Services Cooperative, or Kelly Benefits, file before that deadline, then freeze your credit and keep every notice in one folder. If your breach isn’t listed, bookmark this page. When a new class action lawsuit data breach victims can file in opens, it goes to the top of the table with its deadline and official claim link.
Data Breach Class Action FAQ
How much compensation will I get for a data breach?
Most people who file without receipts get a small cash payment, often $25 to $100. Claimants with documented out-of-pocket losses can recover much more, up to $25,000 in the largest settlements. Pro rata payments shrink as more people file.
How do I find out if I am part of a class action lawsuit?
You’re usually a class member if you received the company’s breach notice. The settlement website spells out the exact class definition, and many let you look up your notice ID. If you got no notice, contact the administrator before the deadline.
How do I find out if my data was breached?
Check your mail and inbox first, since state notification laws require companies to send a notice. California’s attorney general also publishes a searchable list of incidents reported to the state, a quick way to confirm a letter matches a real incident. If you see fraud, report it at IdentityTheft.gov.
Can I still file a claim after the deadline passes?
No. Once the claim deadline passes, late claims are generally rejected, and if you didn’t opt out, the settlement’s release still bars you from suing on your own. Some benefits, such as identity theft protection services, can stay available to all class members for years.
Do I need a lawyer to file a data breach claim?
No. Class counsel already represents every class member, and their fees come out of the settlement fund. Filing a claim on the official site is free.
This page explains how these settlements generally work. It isn’t legal advice. For advice about your own situation, talk to a licensed attorney.
Sources
- National Conference of State Legislatures, Security Breach Notification Laws
- TransUnion LLC v. Ramirez, 594 U.S. (2021), U.S. Supreme Court opinion
- California Civil Code Section 1798.150 (CCPA private right of action)
- FTC Consumer Advice, Credit Freezes and Fraud Alerts
- IdentityTheft.gov (Federal Trade Commission)
- FTC, Equifax Data Breach Settlement
- California Attorney General, Search Data Security Breaches
- WAFB, AT&T settlement gets final approval (October 9, 2026)
- Official administrator sites: Nelnet, Capital One, AT&T, 23andMe, T-Mobile, Doxim, Lands’ End, FinWise Bank, ConnectOnCall, Summit Medical Group, American Vision Partners, Laboratory Services Cooperative, Kelly Benefits