Data Breach Compensation in 2026: What You Can Actually Claim, How Much, and Which Settlements Are Paying
Quick Answer
- Data breach compensation is real and paid through court-approved class action settlements, not government programs.
- Payouts range from under $60 for basic claims to $5,000 or $10,000 for documented losses, depending on the case.
- Deadlines are case-specific: CPAP Medical claims close November 26, 2026, and Academy Mortgage notices go out by October 29, 2026.
Data breach compensation means money or services you receive after your personal information is exposed in a security incident. In the United States, this compensation comes almost entirely through class action settlements. There is no federal agency that writes you a check for a breach. You file a claim in a specific case, and the settlement administrator handles the rest.
If your information was exposed, you have probably received a notice in the mail or seen a headline about a settlement. The numbers you see in those headlines rarely match what individual people receive. A $350 million settlement can mean $56 per person. A $10.5 million settlement can mean three years of free credit monitoring. The gap between headline and reality is where most people get confused.
This article breaks down how data breach compensation actually works, what the recent settlements paid, how to file a claim, and what deadlines are coming. One surprising fact: the largest single payouts often go to people who documented specific out-of-pocket losses, not to everyone in the class.
The Facts
| Case | Multiple active settlements (see table below) |
|---|---|
| Status | Various: some paying, some accepting claims, some pending approval |
| Fund Size | Ranges from $500,000 to $350 million per settlement |
| Est. Per Person | $56 to $10,000, depending on documentation and case |
| Claim Deadline | Case-specific; CPAP deadline Nov. 26, 2026 |
| Administrator | Kroll, Angeion Group, and others depending on case |
| Proof Needed | None for basic payment; receipts needed for documented losses |
Is Data Breach Compensation Real or a Scam?
Data breach compensation is real. Federal courts oversee these settlements, and settlement administrators distribute money and services under court-approved plans. The Lemonade settlement received final approval in September 2026 . The 23andMe settlement was announced by 42 state attorneys general in July 2026 . These are public, verifiable proceedings.
Scams exist, and they follow a predictable pattern. Someone texts or calls claiming you have unclaimed breach money. They ask for a fee to release it. They want your Social Security number to “verify” you. None of that happens in a legitimate settlement. The settlement administrator already has your information from the company that was breached. You file a claim, and you pay nothing.
The other scam to watch for is fake claims websites. If a site is not the one named in your official notice or court documents, do not enter your information. The legitimate administrator for each case is named in the settlement agreement and court order.
Key Takeaway: Data breach settlements are court-supervised and legitimate, but you should only file through the official settlement website named in your notice, and you should never pay a fee to claim.
How Much Money Can You Get From a Data Breach Settlement?
Data breach settlement payouts depend on the settlement fund, the number of claims filed, and whether you can document losses. Basic payments for people without receipts typically range from $25 to $100. Documented loss claims can reach $3,000 to $10,000 depending on the case.
Here is what recent settlements have actually paid or offered:
| Settlement | Fund Size | Basic Payment | Documented Loss Cap | Status |
|---|---|---|---|---|
| T-Mobile (2021 breach) | $350 million | $56.54 average | Up to $25,000 | Paid, closed |
| Lemonade | $10.5 million | Pro rata cash | Up to $10,000 | Final approval Sept. 2026 |
| CPAP Medical | $500,000 | Pro rata | Up to $5,000 | Claims due Nov. 26, 2026 |
| Academy Mortgage | $1.995 million | Pro rata (CA gets double) | Up to $3,000 | Notices due Oct. 29, 2026 |
| MedData | $7 million | Up to $500 | Up to $5,000 | Preliminary approval |
| 23andMe | $18 million | Limited recovery | Not specified | Announced July 2026 |
The T-Mobile settlement is the most instructive example. The fund was $350 million, and original estimates suggested $25 per person. Because fewer people filed claims than expected, the leftover money was redistributed, and the average payment rose to $56.54 per account holder . Some people with documented losses received over $4,000 .
The Lemonade settlement offers three years of credit monitoring valued at nearly $720 per person, plus a pro rata cash payment and up to $10,000 for documented losses . The CPAP Medical settlement offers two years of medical data monitoring, up to $5,000 for documented losses, but no alternative cash payment for people without receipts .
Reality Check: The biggest payouts go to people who keep receipts. If you paid for credit monitoring, lost time from work, or had fraudulent charges after a breach, document those costs. That is where the real money is.
Who Qualifies for Data Breach Compensation?
You qualify for data breach compensation if you received a notice that your personal information was involved in a specific breach, or if you meet the class definition in a settlement. You do not need to prove that the breach caused a specific harm to file a basic claim.
The Academy Mortgage settlement class is “every living person residing in the United States who was notified by Academy Mortgage that their personal information may have been affected” . The CPAP Medical class covers “current and former patients and employees” whose information was compromised in the December 2024 incident . The Lemonade class covers approximately 190,000 individuals whose driver’s license numbers were exposed .
Some settlements have different rules for different states. The Academy Mortgage settlement pays California residents double the standard pro rata amount if they submit a sworn attestation of residency . This reflects California’s stronger statutory damages framework.
You generally cannot claim in a settlement if you were not part of the affected population, if you opted out, or if you are a judge or attorney involved in the case. Those exclusions are standard.
How to File a Data Breach Claim
You file a data breach claim by going to the official settlement website named in your notice, completing the claim form, and submitting it before the deadline. The process takes minutes for a basic claim. Documented loss claims require receipts.
Here are the steps:
- Find your notice or look up the settlement website from court documents.
- Read the class definition to confirm you are included.
- Choose your claim type: basic cash payment, documented losses, or both.
- Gather receipts if claiming documented losses.
- Complete the online or mailed claim form.
- Submit before the deadline printed on the notice.
- Save your confirmation number or a copy of your submission.
- Watch for payment by check, PayPal, or prepaid card.
For the CPAP Medical settlement, claims must be submitted by November 26, 2026, and opt-outs are due October 30, 2026 . For Academy Mortgage, the website and notices were due by October 29, 2026, and the claim deadline will be printed on the notice .
The Cencora settlement, one of the largest recent data breach cases with a $40 million fund, had a claims deadline of January 19, 2026, which has already passed . If you missed that one, watch for future settlements involving the same incident.
When Will You Get Paid From a Data Breach Settlement?
Payment timing depends on when the settlement receives final approval and when the claims period closes. Most settlements pay within six to twelve months after the claim deadline, though some take longer.
The sequence works like this. First, the court grants preliminary approval. Second, notices go out and the claim period opens. Third, the claim deadline passes. Fourth, the court holds a final approval hearing. Fifth, the administrator calculates payments. Sixth, checks or electronic payments go out.
For the Lemonade settlement, final approval came in September 2026, and payments should follow within months . For CPAP Medical, the final fairness hearing was scheduled for December 1, 2026, with payments to follow . For Academy Mortgage, no payment date had been announced as of October 1, 2026 .
If you filed a claim and the deadline passed months ago, you can check the settlement website for status updates. Administrators often post distribution timelines there.
Key Takeaway: Data breach settlements pay between $25 and $10,000 depending on documentation, but you must file a claim by the deadline in your notice, and payments typically arrive six to twelve months later.
What Happens If Your Data Was Breached But No Settlement Exists?
If your data was breached but no settlement exists yet, you have limited options for immediate compensation. You can wait for a class action to be filed and settled, you can pursue an individual lawsuit if your losses are large enough, or you can take protective steps on your own.
Not every breach produces a settlement. Some cases get dismissed. In a case involving IBM and Johnson & Johnson’s Janssen CarePath platform, a federal judge dismissed the class action entirely, holding that plaintiffs failed to establish concrete injury . The court found that the risk of future harm was not enough to sustain the claims.
In a European case involving a music streaming platform, a German court ruled that users affected by a data leak had no right to non-material compensation because they could not prove specific damage beyond general fear of misuse . The court emphasized that “mere unauthorized access to personal data cannot per se be considered a liability-triggering disadvantage” .
If you have significant documented losses, an individual lawsuit may make sense. If your losses are small or speculative, waiting for a class action is usually the practical choice.
Data Breach Compensation Under GDPR vs. U.S. Law
Data breach compensation under GDPR in Europe is different from U.S. class action settlements. The EU’s General Data Protection Regulation gives individuals a direct right to compensation, but courts have set a high bar for what qualifies.
The Court of Justice of the European Union ruled in 2024 that GDPR compensation serves a purely compensatory function, not a punitive one . The court also said that non-material damage from a data breach is “not, by its nature, less significant than physical injury” . That sounds favorable to claimants, but the practical result has been mixed.
German and Danish courts have rejected claims where plaintiffs could not prove specific harm beyond anxiety. The Danish Supreme Court ruled in December 2025 that fear and negative feelings after a laptop theft were not “well-founded” enough to justify compensation . The court found no evidence the data was misused.
In the U.S., class action settlements often pay regardless of proven harm because the class is certified based on the breach itself, not individual damages. That makes U.S. settlements more predictable for ordinary people, even if the amounts are small.
What Happens Next in Data Breach Litigation
The next stages depend on pending settlements and new cases. Here is the expected timeline:
October 29, 2026: Academy Mortgage settlement website and mailed notices due; claim deadline to follow .
October 30, 2026: CPAP Medical opt-out and objection deadline .
November 26, 2026: CPAP Medical claim deadline .
December 1, 2026: CPAP Medical final fairness hearing .
Pending: Payment distribution in the Lemonade settlement following September 2026 final approval .
Ongoing: New data breach class actions filed as incidents occur, including the ServiceTitan case filed in September 2026 .
Frequently Asked Questions
How much can I get from a data breach settlement?
Basic payments range from $25 to $100. Documented losses can reach $3,000 to $10,000 depending on the settlement.
Do I need a lawyer to claim data breach compensation?
No, you file claims directly with the settlement administrator. Lawyers represent the class, not individual claimants.
Is data breach compensation taxable?
Settlement payments for physical injury or reimbursement of expenses are generally not taxable. Payments for emotional distress may be taxable. Consult a tax professional.
What happens if I miss the claim deadline?
You generally cannot file a late claim. Some settlements allow extensions, but they are rare.
Can I file claims in multiple data breach settlements?
Yes, if you were affected by multiple breaches and meet each class definition.
How long does it take to get paid?
Payments usually arrive six to twelve months after the claim deadline, sometimes longer.
What if my data was breached but I never got a notice?
You may still be in the class if the court approved substitute notice. Check the settlement website for the class definition.
Is it worth filing a claim for $56?
Yes, because it takes minutes and costs nothing. The money is yours, and small amounts add up across multiple settlements.
What You Should Do Now
Check your mail and email for data breach settlement notices. If you find one, confirm the deadline and file a claim before it passes. The CPAP Medical deadline is November 26, 2026, and Academy Mortgage claim details are expected by late October.
Gather any receipts for credit monitoring, identity theft protection, or other costs you incurred after a breach. Those documented losses are where the larger payouts come from. The single most important action is filing before the deadline, because missing it means getting nothing.
