Data Breach Lawsuit in 2026: What You Can Recover, How to File, and What the FTC Is Doing
Quick Answer
- Data breach lawsuits let you recover documented losses up to $10,000 or more, plus statutory cash payments in some states.
- The 23andMe settlement pays up to $165 for health info claims and $100 for statutory claims in four states.
- Most data breach settlements require you to submit a claim form with documentation before the deadline.
If your personal data was exposed in a breach, you might be able to recover money. But the process is not automatic, and the amounts are usually smaller than people expect.
Data breach lawsuits take two main forms. Class actions let consumers recover documented losses and sometimes a flat cash payment. Regulatory actions by the FTC or state attorneys general force companies to improve security but do not pay you directly.
The 23andMe settlement is the biggest consumer-facing example in 2026. A $46.75 million fund was set up for U.S. consumers who submitted claims before February 17, 2026 . The FTC’s order against Illuminate Education affects 10.1 million students but pays no direct cash to families .
This article explains what you can actually recover, how to file a claim, and why some settlements pay $50 while others pay thousands.
The Facts
| Item | Details |
|---|---|
| 23andMe Settlement Fund | $46.75 million class action + $18 million state AG recovery |
| 23andMe Claim Deadline | February 17, 2026 (passed) |
| 23andMe Health Info Payment | Up to $165 |
| 23andMe Statutory Cash Claim | Estimated $100 (AK, CA, IL, OR residents) |
| 23andMe Documented Loss Cap | Up to $10,000 |
| Illuminate Education Breach | 10.1 million students affected |
| FTC Order Date | June 5, 2026 (final approval) |
| Typical Data Breach Settlement | $50 flat cash or up to $5,000 for documented losses |
How Much Can You Get from a Data Breach Lawsuit?
Most data breach class action settlements pay between $50 and $165 in flat cash, or up to $5,000 to $10,000 if you have documented losses like identity theft or fraud .
The flat payment is what most people receive. The larger amounts require proof that the breach caused you specific financial harm.
The 23andMe settlement shows how the tiers work:
| Claim Type | Payment Amount | What You Need |
|---|---|---|
| Health Information Claim | Up to $165 | You received notice your health data was accessed |
| Statutory Cash Claim | Estimated $100 | You lived in AK, CA, IL, or OR during the breach period |
| Documented Loss Claim | Up to $10,000 | Receipts, bank statements, or invoices showing fraud or identity theft costs |
| Identity Theft Insurance | Available | All class members |
The health information payment applies if 23andMe notified you that your raw genetic data, health reports, or self-reported health conditions were accessed . The statutory claim is specific to residents of four states with stronger consumer protection laws.
For documented losses, you need real proof. Credit card statements, police reports, IRS documents, and invoices from accountants or lawyers all count . Personal declarations alone do not.
Is a Data Breach Lawsuit Settlement Legitimate?
Yes, data breach class action settlements are legitimate, but you should only trust official settlement websites and court-approved notices, not emails or texts promising money .
The 23andMe settlement operates through a court-approved website and a claims administrator (Kroll Settlement Administration). Notices went out through email and mail to people on the class list .
Legitimate settlements have these features:
- A court docket and case number
- A designated claims administrator
- A settlement website with downloadable claim forms
- A final approval hearing date
- Clear instructions for submitting claims
If you get a text saying “you are owed money from a data breach” with a link that does not match the official settlement site, it is a scam. Real settlements do not text you first. They mail or email you based on records the company provided to the court.
The 23andMe settlement had a final approval hearing on January 20, 2026 . That is a matter of public record.
Who Qualifies for a Data Breach Settlement?
You qualify for a data breach settlement if you were a customer or user of the breached company during the specified time period and you received notice that your data was exposed .
For 23andMe, the class includes anyone who was a customer at any time during May 1, 2023 through October 1, 2023 . The breach affected 6.9 million people worldwide, including about 148,585 in New Jersey alone .
For other settlements, the eligibility window varies. The Dohman Akerlund & Eddy settlement covers people whose data was exposed in that specific breach. The Pierce County Library settlement covers library patrons. Each settlement defines its own class.
You do not need to prove that hackers actually used your data. You just need to be in the class and submit a claim by the deadline.
How Do You File a Data Breach Claim?
Filing a data breach claim usually takes 10 to 15 minutes online, and you do not need a lawyer to do it.
Here are the steps:
- Find the official settlement website. The notice you received should have the URL. If you lost it, search the case name plus “settlement.”
- Check your eligibility. The website will have a class definition. Confirm you meet it.
- Gather documentation if claiming losses. Receipts, bank statements, and invoices support your claim.
- Fill out the claim form. You can usually do this online or by mail.
- Choose your payment method. Many settlements offer PayPal, Venmo, or physical check.
- Submit before the deadline. Late claims are rejected.
- Keep a copy. Save your confirmation number.
The 23andMe claim form asked people to certify their residency during the breach period for statutory claims and to attach documentation for loss claims . The deadline was February 17, 2026.
Key Takeaway: Filing a data breach claim is free and does not require a lawyer. The most important step is submitting before the deadline with whatever documentation you have.
What Is the FTC Doing About Data Breaches?
The FTC brings enforcement actions against companies that fail to protect consumer data, but those actions do not pay money directly to affected individuals .
In June 2026, the FTC finalized an order against Illuminate Education, a Wisconsin-based education technology provider. The FTC alleged that Illuminate failed to secure student data, leading to a breach that exposed 10.1 million students’ personal information, including health records .
The order requires Illuminate to:
- Delete personal information not reasonably needed
- Stop collecting data it does not need
- Publish a data retention schedule
- Implement a comprehensive security program
- Notify the FTC of future breaches
Reality Check: The FTC does not send you a check. Its orders force companies to change practices. If you want compensation for a breach, you need a class action settlement, not a regulatory action.
What Is the Illuminate Education Data Breach Lawsuit?
The Illuminate Education breach exposed data for 10.1 million students, and the FTC finalized a settlement order in June 2026 that requires the company to implement security reforms, but no direct consumer payments were included in the FTC action .
The breach happened between late December 2021 and January 2022. A hacker used a former employee’s login credentials and remained undetected for about 13 days . The data accessed included email and mailing addresses, dates of birth, student records, and health-related information .
The FTC’s complaint alleged that Illuminate knew about security vulnerabilities almost two years before the breach and failed to fix them. The company also failed to notify schools promptly .
The final order, approved on June 5, 2026, requires Illuminate to publish a data retention schedule within 90 days and undergo third-party security assessments every two years for 10 years . The Commission voted 2-0 to finalize the order.
No class action settlement for Illuminate has been confirmed as of October 2026. If one is filed, it would be separate from the FTC action.
Why Do Data Breach Settlements Pay So Little?
Data breach settlements pay small amounts because the harm is often speculative. Courts require proof that the breach caused actual damage, and most people cannot show that.
The math is simple. If 6.9 million people are in a class and the settlement fund is $46.75 million, the per-person payment cannot be large. Only a fraction of the class files claims, so the actual payment depends on how many people submit valid forms.
The 23andMe settlement allocated specific pools:
- $8.3 million for extraordinary claims (documented losses)
- $1.25 million for health information claims
- Remaining funds for statutory claims and administration
If everyone filed a documented loss claim, each would get far less than $10,000. But most people file the simpler claims.
The Rite Aid data breach settlement had a $6.8 million fund and achieved a gross per capita recovery of about $3.09 . That is not a typo. Three dollars per class member.
What Happens Next in Data Breach Litigation?
Ongoing 2026: The 23andMe settlement is in its payment phase. Claims were due February 17, 2026.
Expected late 2026: Payments from the 23andMe settlement may begin mailing after final approval and claim processing.
Ongoing: New data breach class actions are filed regularly as breaches occur.
Watch for: The FTC’s Illuminate order sets a precedent for data minimization requirements that other companies will face.
Ongoing: State attorneys general continue multistate investigations into major breaches.
Frequently Asked Questions
How much can I get from a data breach lawsuit?
Most settlements pay $50 to $165 in flat cash. Documented losses can be reimbursed up to $5,000 to $10,000, but you need receipts and proof.
Do I need a lawyer to file a data breach claim?
No. Filing a claim is free and takes 10 to 15 minutes online. You only need a lawyer if you are pursuing individual litigation outside a class settlement.
How do I know if a data breach settlement is real?
Check for a court case number, a designated claims administrator, and an official settlement website. Real settlements do not text you first.
What documents do I need for a loss claim?
Credit card statements, bank statements, invoices, receipts, police reports, and IRS documents all support a claim. Personal declarations alone are not enough.
What is the deadline for the 23andMe settlement?
The claim deadline was February 17, 2026. It has passed. If you missed it, you cannot file a late claim.
Can I sue a company directly for a data breach?
Yes, but individual lawsuits are expensive and rarely worth it unless your damages are significant. Class actions are the standard route.
What does the FTC order against Illuminate Education require?
It requires Illuminate to delete unnecessary data, stop collecting data it does not need, publish a retention schedule, implement a security program, and notify the FTC of future breaches .
When will I get my data breach settlement payment?
Payment timing varies. Many settlements pay within 6 to 12 months after the claim deadline. Check the settlement website for updates.
If you received a data breach notice, do not ignore it. Find the official settlement website, check your eligibility, and file a claim if the deadline has not passed. The payments are usually small, but they are yours. Document any losses, because that is the only way to recover more than the flat cash amount. And if the deadline has passed, check for other settlements that might cover the same breach.
