⚖️ Breach Settlements Tracker

Equifax agreed to a combined settlement with federal regulators, the states and the consumer class over the 2017 breach of its dispute portal.

Amount: at least $575M, up to $700M; includes consumer fund of up to $425M

Court or agency: FTC, CFPB, state AGs; N.D. Ga. (consumer class)

Equifax Inc. has agreed to pay at least $575 million, and potentially up to $700 million,

T-Mobile settled the consolidated class action over its August 2021 breach; final approval was granted on June 29, 2023 and appeals ended in 2025.

Amount: plus $150M committed to data security spending in 2022 and 2023

Court or agency: W.D. Mo., MDL No. 3019

The company has just announced the terms of a settlement in a consolidated class action lawsuit, and it isn’t cheap: $350 million to be split up by customers (and lawyers), plus $150 million “for data security and related technology.”

Second source ↗

Capital One settled the consumer class action over the 2019 theft of applicant data from its cloud environment.

Amount: final approval September 2022; $53.2M of the fund went to attorney fees

Court or agency: E.D. Va., MDL No. 1:19-md-2915

Capital One Financial Corp. agreed to pay $190 million to settle a class-action lawsuit that customers filed against the firm after a hacker broke into its cloud-computing systems and stole their personal information.

Second source ↗

AT&T settled the consolidated class actions over its two 2024 breaches; a federal judge granted final approval in October 2026.

Amount: $149M for one class and $28M for the other

Court or agency: N.D. Tex.

The preliminary approval order from the court said the company is setting up a $149 million pool of money for one of the settlement classes, and another totaling $28 million for the other.

Second source ↗

The Quebec court approved the largest data breach settlement in Canada's financial sector over an employee's theft of member data.

Amount: C$200.9M maximum, about US$154M

Court or agency: Superior Court of Quebec

The Superior Court of Quebec has approved approximately $201 million Canadian ($154 million) worth of class-action settlement against Canadian financial services firm Desjardins Group for a 2019 data breach, Canadian Underwriter reported citing The Canadian Press.

Second source ↗

Equifax settled investor claims that it misrepresented its data security before the 2017 breach; the court approved the deal after a June 2020 hearing.

Amount: shareholder suit, separate from the consumer settlement

Court or agency: N.D. Ga.

Lead Plaintiff, on behalf of itself and the Settlement Class (defined below), has reached a Settlement of the Action for $149,000,000 in cash that resolves all claims in the Action.

Uber paid all 50 states and DC over its failure to report the 2016 breach, after paying the hackers $100,000 to stay quiet.

Court or agency: State attorneys general

Ridehailing company Uber will pay $148 million across all 50 states and Washington, D.C., as part of a settlement stemming from a data breach that revealed sensitive information on 57 million of the company’s users.

Yahoo revised a rejected earlier deal into a $117.5 million fund covering out-of-pocket losses, credit monitoring and fees.

Amount: common fund; final approval July 2020

Court or agency: N.D. Cal., No. 5:16-md-02752

John Yanchunis, a lawyer for the plaintiffs, in a court filing called the $117.5 million the “biggest common fund ever obtained in a data breach case.”

Second source ↗

Comcast funded a settlement over the unpatched Citrix NetScaler flaw that exposed Xfinity customer data; preliminary approval came in January 2026 and approval in August 2026.

Amount: common fund paid by Comcast; $31.7M to attorney fees

Court or agency: E.D. Pa.

A federal judge has approved a $117.5 million data breach settlement against Comcast Cable Communications.

Anthem settled the consolidated class action over the 2015 breach of its member database, then the largest data breach settlement on record.

Amount: agreed June 2017; final approval August 2018

Court or agency: N.D. Cal., No. 5:15-md-02617

A federal judge in California has given final approval to a $115 million settlement

The OCC assessed a civil money penalty against Capital One for failing to establish effective risk assessment before moving IT operations to the cloud.

Amount: civil money penalty, consented to by the bank

Court or agency: OCC

The Office of the Comptroller of the Currency (OCC) today assessed an $80 million civil money penalty against Capital One, N.A., and Capital One Bank (USA), N.A.

Second source ↗

Yahoo settled investor claims that it hid its breaches while touting its security; final approval came on September 7, 2018.

Amount: shareholder suit; first large securities settlement tied to a data breach

Court or agency: N.D. Cal.

On September 7, 2018, this Court granted final approval to Yahoo’s $80 million settlement of a federal securities class action related to Yahoo’s failure to disclose the 2013, 2014, and 2015- 2016 data breaches.

Conduent signed a settlement over the theft of benefits and health data on about 62 million people; it was filed for court approval on October 16, 2026.

Amount: includes monitoring, fees and administration

Court or agency: D.N.J.

Digital platform provider Conduent has agreed to pay $80m to settle a class action lawsuit following a 2024 cyber incident that breached the personal and health data of around 62 million people.

Second source ↗

Premera settled the member class action over the 2014 network intrusion; checks went out in June 2020.

Amount: $32M cash fund plus $42M in security spending over three years

Court or agency: D. Or.

Under the settlement agreement, which resolves the lawsuit with no admission of liability, Premera will pay $32 million to a fund that will pay the costs of recovery to class members, attorney’s fees, and costs.

Second source ↗

LVHN settled with patients after it refused a ransom and the gang published clinical nude photos of cancer patients; a judge gave final approval in November 2024.

Amount: payments from $50 to $70,000 per person

Court or agency: Lackawanna County Court of Common Pleas, Pa., No. 23-CV-1149

Lehigh Valley Health Network has agreed to a $65 million settlement of a class action with patients and employees affected by a 2023 ransomware attack that exposed personal and medical information including nude photos of patients.

Second source ↗

The federal government and its background check contractor settled the class action over the 2015 theft of security clearance records after seven years of litigation.

Amount: minimum $700 per valid claim, up to $10,000

Court or agency: D.D.C.

A federal judge has given final approval for a proposed $63 million settlement to bring to an end a class action lawsuit brought over the Office of Personnel Management data breaches in 2015.

Second source ↗

The OCC penalized Morgan Stanley for failing to oversee the decommissioning of two wealth management data centers whose devices still held customer data.

Amount: civil money penalty

Court or agency: OCC

The Office of the Comptroller of the Currency (OCC) today assessed a $60 million civil money penalty against Morgan Stanley Bank, N.A., and Morgan Stanley Private Bank, N.A.

Morgan Stanley settled the customer class action over unencrypted equipment resold after data center decommissioning.

Amount: plus at least two years of fraud insurance

Court or agency: S.D.N.Y., No. 20-cv-05914

A preliminary settlement of the proposed class action on behalf of about 15 million customers was filed Friday night in Manhattan federal court and requires approval by U.S.

Fred Hutch settled with patients whose stolen records were used to send them extortion and swatting threats.

Amount: total value; about $11.5M cash, $13.5M security upgrades, $25.5M fraud monitoring and insurance

Court or agency: Washington state court

A Seattle cancer facility has agreed to fork out around $52.5 million as part of a class action settlement linked to a Thanksgiving 2023 cyberattack where criminals directly threatened cancer patients with swat attacks.

Second source ↗

Marriott agreed to pay the states and overhaul its data security, alongside a parallel FTC consent order.

Amount: paid to the states; FTC order carries no payment

Court or agency: State attorneys general; FTC

Today’s settlement with 50 attorneys general requires Marriott to significantly overhaul and strengthen its data security to protect customers’ private information and pay $52 million in penalties, of which New York will receive $2.29 million.

Second source ↗

Wendy's agreed to pay card-issuing banks and credit unions over franchise point-of-sale malware; the deal was then pending court approval.

Amount: Wendy's said its own share after insurance was $27.5M

Court or agency: W.D. Pa.

The Wendy’s Co. on Wednesday said it has agreed to pay $50 million to a group of financial institutions to settle claims following a data-card breach that hit the chain in 2015 and 2016.

Second source ↗

Blackbaud paid the states and agreed to overhaul its security and breach notice practices after the 2020 ransomware attack.

Court or agency: State attorneys general

Under the settlement, Blackbaud has agreed to overhaul its data security and breach notification practices and make a $49.5 million payment to states.

Second source ↗

Anthem resolved the multistate and California investigations into its 2015 breach.

Amount: $39.5M multistate plus $8.7M California

Court or agency: State attorneys general

One settlement was agreed with Attorneys General in 43 states and Washington D.C for $39.5 million and a separate settlement was reached with the California Attorney General for $8.7 million.

After 23andMe filed for Chapter 11, its $30 million class deal was enlarged and a St. Louis bankruptcy judge approved a $46.75 million settlement.

Amount: $30M pre-bankruptcy deal revised in bankruptcy to a $30M to $50M fund; approved at $46.75M, less $14.29M already paid

Court or agency: N.D. Cal.; U.S. Bankruptcy Court, E.D. Mo., No. 25-bk-40976

What we know: The court approved a $46.75 million settlement, which will be reduced by the $14.29 million already distributed, leaving the remaining balance to be paid.

Second source ↗

MGM settled the consolidated class action over two breaches, including the 2023 social engineering and ransomware attack that shut down Las Vegas casinos; final approval came in June 2025.

Court or agency: D. Nev.

A $45 million settlement of a consolidated class action against MGM Resorts International over two data breach incidents that provides for payments of up to $15,000 in documented losses for class members was declared “fundamentally fair, reasonable, adequate, and in the best interests of the Settlement Class”

Second source ↗

Cencora and its Lash Group patient-support unit settled claims over the 2024 theft of patient data; final approval followed a February 2026 hearing.

Court or agency: E.D. Pa., No. 2:24-cv-02961

The defendants chose to settle the lawsuit with no admission of wrongdoing or liability and will establish a $40 million settlement fund to cover attorneys’ fees (up to $13,333,333.33), attorneys’ expenses (up to $300,000), service awards to the 28 class representatives (total $42,000), and settlement administration costs (yet to be determined).

Second source ↗

Target settled card issuers' claims over the cost of reissuing cards and fraud after the 2013 breach.

Amount: about $20M to institutions and $19M to Mastercard's Account Data Compromise program

Court or agency: D. Minn., MDL No. 2522

Two years after one of the largest data breaches in retail history was discovered, Target settled a class action lawsuit with financial institutions for $39.4 million.

The SEC charged Morgan Stanley Smith Barney with failing to protect customer data when it hired a moving company with no data destruction experience to retire devices.

Amount: civil penalty, no admission

Court or agency: SEC

MSSB has agreed to pay a $35 million penalty to settle the SEC charges.

The SEC penalized the former Yahoo for misleading investors by not disclosing the 2014 breach for about two years.

Amount: civil penalty; first SEC penalty over a failure to disclose a breach

Court or agency: SEC

has agreed to pay a $35 million penalty

Flagstar settled claims over breaches tied to Accellion's legacy file transfer appliance; preliminary approval came in March 2026.

Court or agency: E.D. Mich., No. 21-cv-10657

Flagstar Bank FSB will pay $31.5 million to settle allegations it failed to protect the personal information of nearly 2.2 million people in data breaches linked to Accellion Inc.'s file-transfer software, under a deal given initial approval in federal court.

Second source ↗

Home Depot settled card-issuing banks' claims over the 2014 breach with a fixed payment of about $2 per compromised card.

Court or agency: N.D. Ga.

In the latest settlement of legal claims arising out of a massive 2014 data breach at Home Depot, the retailer has agreed to pay $27.25 million to affected financial institutions.

SolarWinds settled investor claims over the Orion supply chain compromise; the court approved it after a July 28, 2023 hearing.

Amount: paid by D&O insurance

Court or agency: W.D. Tex., No. 1:21-cv-00138

On February 8, 2023, the court granted preliminary approval of the settlement, and on March 2, 2023, we paid $26 million

Bayview and Lakeview settled borrowers' claims over the 2021 servicing breach; Judge Darrin Gayles entered final judgment in July 2026.

Court or agency: S.D. Fla., No. 22-cv-20955

Bayview agreed to a $26 million settlement with 5,774,688 class members, one of the largest data breach deals in the mortgage space in recent years.

loanDepot settled claims over the January 2024 attack on its systems with cash, monitoring and security commitments.

Amount: plus monitoring and security upgrades; judge valued the total at over $42M

Court or agency: C.D. Cal.

On top of paying $25 million as recompense, the mortgage lender will pay for financial monitoring and improve its security practices, according to court documents filed to the US District Court for the Central District of California docket Wednesday.

LastPass settled claims from users whose stolen vault backups were linked to cryptocurrency thefts; the deal won preliminary approval in February 2026.

Amount: up to; $8.2M general fund plus about $16.3M separate fund

Court or agency: D. Mass., No. 22-cv-12047

LastPass USA LLP will pay up to nearly $24.5 million to settle a proposed class action over a 2022 data breach that exposed the personal information of millions of people and led to the looting of cryptocurrency accounts, under a deal given initial approval in federal court.

State financial regulators took their first joint enforcement action over a mortgage company data breach.

Amount: penalty plus corrective plan

Court or agency: State financial regulators (multistate, CSBS)

The $20 million settlement and corrective plan is the first collective multistate enforcement action by state regulators for a mortgage company data breach.

Robinhood settled claims from customers whose accounts were taken over, and agreed to add supplemental two-factor authentication and takeover monitoring.

Amount: plus two years of credit monitoring

Court or agency: N.D. Cal., No. 5:21-cv-01013

moved closer to paying $20 million as part of a class-action settlement with thousands of customers

Home Depot settled consumer claims with a cash fund for out-of-pocket losses and credit monitoring.

Amount: $13M cash fund plus about $6M in credit monitoring

Court or agency: N.D. Ga.

Consumers last year received a $19 million settlement that included a $13 million cash fund as well as $6 million in credit monitoring services.

Target settled the multistate investigation into the 2013 point-of-sale malware breach, then the largest multistate data breach settlement.

Court or agency: State attorneys general

Retailer Target Corp reached an $18.5 million settlement with 47 states and the District of Columbia over a massive data breach in late 2013.

Connecticut's largest health system settled claims over the March 2025 theft of patient data; a final approval hearing was set for March 3, 2026.

Court or agency: U.S. federal court

has agreed to pay $18 million to settle proposed class action litigation involving a March hacking incident.

Home Depot paid the states and agreed to hire a CISO and strengthen security over the 2014 payment card breach.

Court or agency: State attorneys general

U.S. states have reached a settlement over the mammoth 2014 Home Depot breach that will net them $17.5 million, plus an agreement from the home improvement retailer to strengthen its data security practices.

Infosys McCamish agreed after mediation to fund a settlement of seven class actions, and the court granted final approval on December 18, 2025.

Court or agency: U.S. federal court

Under the proposed scheme, McCamish was asked to pay $17.5 million into a fund to settle the matter.

Anthem paid the largest HIPAA settlement to that date over the phishing-led 2015 breach.

Amount: resolution amount plus two-year corrective action plan

Court or agency: HHS OCR

Anthem has agreed to pay OCR $16 million and will undertake a robust corrective action plan to address the compliance issues discovered by OCR during the investigation.

Experian and T-Mobile paid the states and agreed to security improvements over breaches at the credit bureau.

Amount: more than $16M combined: about $13.67M from Experian and $2.43M from T-Mobile

Court or agency: State attorneys general

Under the settlements with Experian and T-Mobile, the companies have agreed to improve their data security practices and to pay the states a combined amount of more than $16 million.

T-Mobile paid a civil penalty and committed to zero trust and phishing-resistant MFA to close FCC probes into three years of breaches.

Amount: civil penalty, plus a matching $15.75M cybersecurity investment

Court or agency: FCC Enforcement Bureau

As part of the settlement, the company will also pay a $15.75 million civil penalty to the U.S.

AT&T paid a civil penalty and agreed to vendor and data-retention controls after customer data left with a vendor years earlier was stolen.

Amount: civil penalty

Court or agency: FCC Enforcement Bureau

The Federal Communications Commission today announced a $13 million settlement with AT&T to resolve an Enforcement Bureau investigation into the company’s supply chain integrity

The owner of the Ashley Madison dating site settled US claims from users whose details were published after the 2015 hack.

Court or agency: E.D. Mo., MDL No. 2669

The owner of the Ashley Madison adultery website said on Friday it will pay $11.2 million to settle U.S. litigation brought on behalf of roughly 37 million users whose personal details were exposed in a July 2015 data breach.

Second source ↗

ICE paid a penalty for causing nine subsidiaries, including the NYSE, to miss Regulation SCI notice duties after a VPN intrusion.

Amount: civil penalty

Court or agency: SEC

$10 million penalty to settle charges that it caused the failure of nine wholly-owned subsidiaries,

Target settled consumer claims with a fund paying up to $10,000 per person for documented losses and agreed to appoint a CISO.

Amount: plus attorney fees paid separately

Court or agency: D. Minn., MDL No. 2522

A Minnesota judge has endorsed a settlement in which Target Corp. will pay $10 million to settle a class-action lawsuit over a massive data breach in 2013.

Advance Auto Parts was one of the first defendants to settle out of the Snowflake customer-account breach litigation; final approval was entered October 23, 2025.

Court or agency: D. Mont., MDL No. 3126

Advance Auto Parts Inc. will pay $10 million and Neiman Marcus Group LLC will pay $3.5 million to settle allegations they negligently failed to protect consumers’ and employees’ sensitive information that was exposed in data breaches

Second source ↗

Premera paid 30 states and agreed to specific security controls and a CISO over the hack of its network.

Amount: in addition to the $74M class settlement

Court or agency: State attorneys general (consent decree in Washington state court)

Attorney General Peterson and 29 other attorneys general entered into a settlement today that requires Premera Blue Cross, the largest health insurance company in the Pacific Northwest, to pay a total of $10 million to the states over its failure to secure sensitive consumer data.

The SEC charged Unisys with describing known intrusions as hypothetical risks.

Amount: civil penalty

Court or agency: SEC

Unisys will pay a $4 million civil penalty;

Blackbaud settled SEC charges that it understated the scope of the 2020 ransomware data theft to investors.

Amount: civil penalty

Court or agency: SEC

to pay a $3 million civil penalty

Pearson settled charges that it described a breach that had already happened as a hypothetical risk in its filings.

Amount: civil penalty

Court or agency: SEC

agreed to pay $1 million to settle charges that it misled investors about a 2018 cyber intrusion.

The SEC charged Avaya with minimizing the scope of a known intrusion in its disclosures.

Amount: civil penalty

Court or agency: SEC

Avaya. will pay a $1 million civil penalty;

The SEC charged Check Point with describing known intrusions in generic, hypothetical terms.

Amount: civil penalty

Court or agency: SEC

Check Point will pay a $995,000 civil penalty; and

The SEC charged Mimecast with leaving out material details of a known intrusion.

Amount: civil penalty

Court or agency: SEC

Mimecast will pay a $990,000 civil penalty.

The SEC charged First American with disclosure control failures because executives were never told that security staff had found the vulnerability months earlier.

Amount: civil penalty; disclosure controls case

Court or agency: SEC

First American agreed to a cease-and-desist order and to pay a $487,616 penalty.

Capita admitted liability and agreed to pay a reduced penalty under a voluntary settlement with the ICO over the 2023 attack on its pension administration business.

Amount: GBP 14M (GBP 8M plus GBP 6M), cut from a provisional GBP 45M; agreed as a voluntary settlement

Court or agency: UK ICO

Capita has acknowledged our decision and admitted liability, agreeing to pay a final penalty of £14 million without appealing.

Advanced agreed a voluntary settlement with the ICO over missing MFA, patching and vulnerability scanning before the 2022 ransomware attack.

Amount: GBP 3,076,320, halved from a provisional GBP 6.09M; Advanced acted as a data processor for the NHS

Court or agency: UK ICO

Advanced has acknowledged our decision to impose a reduced fine and agreed to pay a final penalty of £3,076,320 without appealing.