Capital One Data Breach Settlement: 2026 Claim Status, Payout Amounts & Deadlines
Quick Answer
- The Capital One data breach settlement is real, resulting from a 2019 breach affecting approximately 98 million U.S. consumers.
- Claimants may receive reimbursement for documented out-of-pocket losses, with the settlement fund totaling $190 million.
- The original claim deadline was September 30, 2022, and late claims are generally not accepted, but check the official site.
If you had a Capital One account or applied for one before 2019, you may have received a settlement notice. The 2019 data breach exposed personal information for around 98 million people in the United States and 6 million in Canada.
The settlement resolved class action litigation against Capital One over the breach. A $190 million fund was established to compensate affected consumers for documented losses and provide restoration services.
This article explains where the settlement stands in 2026, whether you can still file, what payments have looked like, and how to verify any communication you receive. One verified detail many people miss: the breach involved a former Amazon Web Services employee who accessed data through a misconfigured firewall.
The Facts
| Category | Details |
|---|---|
| Case Name | In re: Capital One Consumer Data Security Breach Litigation |
| Court | U.S. District Court for the Eastern District of Virginia |
| Case Number | 1:19-md-2915 |
| Current Status | Settlement approved, distribution ongoing |
| Total Settlement Fund | $190 million |
| Estimated Per-Person Payout | $25 to $10,000+ depending on documented losses |
| Claim Deadline | September 30, 2022 (original) |
| Settlement Administrator | Epiq Class Action & Claims Solutions |
| Final Approval Hearing | July 2022 |
| Proof Needed | Varies by claim type, receipts for out-of-pocket losses |
Is the Capital One Data Breach Settlement Legit?
The Capital One data breach settlement is legit. It resulted from real litigation in federal court, a certified class, and a court-approved settlement. The settlement administrator, Epiq, is a well-established claims processor used in many large class actions.
The breach itself is verified fact. In July 2019, Capital One announced that an unauthorized person accessed personal information of about 100 million people in the U.S. and 6 million in Canada. The compromised data included names, addresses, credit scores, credit limits, balances, and in some cases Social Security numbers and bank account numbers.
The settlement did not require Capital One to admit wrongdoing. The company stated at the time that no credit card account numbers or login credentials were compromised, though other personal data was exposed.
What Makes the Settlement Legitimate
- Court-approved final approval order entered in 2022
- Independent settlement administrator appointed by the court
- Federal and state regulators investigated the breach
- The hacker was convicted and sentenced in federal court
- Public settlement website maintained with claim information
What Is Not Legitimate
- Text messages claiming you have an unclaimed check ready now
- Emails asking for your bank account password to deposit settlement funds
- Anyone charging a fee to “expedite” or “unlock” a Capital One settlement payment
- Websites that are not the official Epiq-administered settlement site
Key Takeaway: The settlement is real, but the claim window has closed. Any new message about easy money is likely a scam.
How Much Did the Capital One Data Breach Settlement Pay?
The Capital One data breach settlement paid varying amounts depending on claim type. Claimants with documented out-of-pocket losses could recover up to $25,000 in cash. Those without documentation could claim reimbursement for lost time at $25 per hour up to 15 hours.
The $190 million fund covered several categories. Reimbursement for fraud losses, identity theft expenses, credit monitoring costs, and lost time were the main payment buckets.
Actual payment amounts varied widely. Many class members who filed only for lost time received modest payments, often under $100. Those who documented significant fraud losses received larger amounts, sometimes thousands of dollars.
Settlement Payment Categories
| Claim Type | Maximum Amount | Documentation Required |
|---|---|---|
| Out-of-pocket losses | Up to $25,000 | Receipts, statements, police reports |
| Lost time | $25 per hour, up to 15 hours | Self-certification |
| Identity defense services | Actual cost | Receipts |
| Credit monitoring | Actual cost | Receipts |
| Account restoration | Actual cost | Receipts |
The actual average payment has not been publicly confirmed by the administrator. Individual payments depended on the total number of valid claims, the dollar amount claimed, and the documentation provided.
Can I Still File a Capital One Data Breach Claim in 2026?
You generally cannot file a new Capital One data breach claim in 2026. The claim deadline was September 30, 2022. The court set that deadline in the settlement approval order.
There are limited exceptions. If you submitted a claim before the deadline and it was denied, you may have had the right to appeal within a specified window. That window has also closed.
The settlement administrator may still process late claims in rare circumstances, such as a court order or a demonstrated technical failure in the filing system. Those cases are exceptional, not routine.
Steps If You Think You Filed a Claim
Step 1: Check your email records for a claim confirmation from Epiq.
Step 2: Visit the official settlement website and look for a claim status lookup tool.
Step 3: Call the settlement administrator’s toll-free number listed on the official site.
Step 4: Have your claim confirmation number ready if you have one.
Step 5: Do not pay anyone to check your claim status. That service is free.
Step 6: If you never filed, understand that you likely missed the deadline.
Missing the claim deadline in a class action is like missing a store return window. Once it closes, the decision is final unless the court orders otherwise.
What Was the Capital One Data Breach Settlement Claim Deadline?
The Capital One data breach settlement claim deadline was September 30, 2022. This date was set in the settlement agreement and approved by the court.
The deadline applied to all claim types, including out-of-pocket loss reimbursement, lost time claims, and identity defense services. Class members who did not file by that date lost their right to receive a payment from the settlement fund.
The exclusion and objection deadlines were earlier. Class members who wanted to opt out of the settlement had to do so by August 2022. Those who wanted to object had a similar deadline.
Key Settlement Dates
| Event | Date |
|---|---|
| Breach announced | July 2019 |
| Settlement preliminarily approved | February 2022 |
| Claim deadline | September 30, 2022 |
| Final approval hearing | July 2022 |
| Final approval order | July 2022 |
| Appeals resolved | 2023 |
| Distribution | 2023 to 2026, ongoing |
Key Takeaway: The claim deadline passed more than three years ago. Do not expect to file a new claim now.
Who Was Eligible for the Capital One Data Breach Settlement?
You were eligible for the Capital One data breach settlement if your personal information was compromised in the 2019 breach. The settlement class included U.S. residents whose information was exposed.
The class definition covered people whose data was accessed without authorization. Capital One sent notices to affected individuals, but some notices were returned as undeliverable. Not receiving a notice did not necessarily disqualify you.
The settlement class was certified as part of the settlement approval process. The court found that the class met the requirements for class certification under federal rules.
Eligible Groups
| Group | Basis for Eligibility |
|---|---|
| U.S. consumers | Personal information accessed in the breach |
| Small businesses | Business information accessed in the breach |
| Canadian residents | Separate Canadian settlement, different rules |
The settlement primarily served U.S. consumers. Canadian residents had a separate settlement approved in Canada with different terms and deadlines.
What Data Was Exposed in the Capital One Breach?
The Capital One breach exposed personal information that varied by individual. The compromised data came from credit card applications and accounts.
The hacker accessed files stored on Amazon Web Services servers. The files contained information that customers and applicants provided to Capital One between 2005 and early 2019.
Types of Data Exposed
| Data Type | Approximate Number of People Affected |
|---|---|
| Names and addresses | 98 million U.S. consumers |
| Credit scores and limits | Tens of millions |
| Social Security numbers | About 140,000 |
| Linked bank account numbers | About 80,000 |
| Canadian social insurance numbers | About 1 million |
The hacker, Paige Thompson, was arrested in July 2019. She was convicted in 2022 on wire fraud and computer fraud charges and sentenced to time served plus probation.
What Happened to the Hacker in the Capital One Breach?
The hacker in the Capital One breach was Paige Thompson, a former Amazon Web Services employee. She was arrested in July 2019 after a tip from another GitHub user.
Thompson exploited a misconfigured firewall on a Capital One server hosted on AWS. She accessed files containing personal information for about 100 million U.S. consumers.
In June 2022, Thompson was convicted in federal court in Seattle on wire fraud and computer fraud charges. She was sentenced in October 2022 to time served, which was approximately three years in custody, plus five years of supervised release.
Hacker Case Timeline
| Event | Date |
|---|---|
| Breach occurred | March 2019 |
| Capital One discovered breach | July 2019 |
| Thompson arrested | July 2019 |
| Criminal trial | June 2022 |
| Conviction | June 2022 |
| Sentencing | October 2022 |
The criminal case against Thompson was separate from the civil settlement. The civil settlement addressed Capital One’s alleged failure to protect customer data.
Did Capital One Admit Fault in the Data Breach Settlement?
Capital One did not admit fault in the data breach settlement. The settlement agreement included a provision stating that the company denied liability.
This is standard practice in class action settlements. Defendants almost always settle without admitting wrongdoing to avoid creating legal precedent that could be used against them in other cases.
Capital One stated publicly that it took responsibility for protecting customer data and had enhanced its security practices. But the legal settlement did not include an admission of liability.
What the Settlement Did and Did Not Do
| Feature | Status |
|---|---|
| Create a compensation fund | Yes, $190 million |
| Require security improvements | Yes, Capital One agreed to security commitments |
| Include admission of fault | No |
| Resolve regulatory actions | Partially, with an OCC fine paid separately |
| Prevent future claims | Yes, for class members who did not opt out |
Capital One paid an $80 million fine to the Office of the Comptroller of the Currency in 2020 for the breach. That fine was separate from the $190 million settlement fund.
How Do I Check My Capital One Settlement Payment Status?
You can check your Capital One settlement payment status through the official settlement administrator. The Epiq-administered website has a claim status lookup feature.
You will need your claim confirmation number or the email address you used when filing. If you do not have that information, you can call the toll-free number listed on the official settlement website.
Do not use third-party websites that claim to check your claim status for a fee. The official status check is free.
Official Payment Status Check Process
| Step | Action |
|---|---|
| 1 | Visit the official settlement website |
| 2 | Click on the claim status or FAQ link |
| 3 | Enter your confirmation number or email |
| 4 | Review the displayed status |
| 5 | Call the administrator if you need help |
Payments have been distributed in waves. Some claimants received checks or digital payments beginning in 2023. Others are still awaiting processing due to claim volume and verification requirements.
Key Takeaway: The settlement is closed to new claims, but existing claimants can still check payment status through the official administrator.
What If I Never Received My Capital One Settlement Check?
If you never received your Capital One settlement check, contact the settlement administrator directly. Epiq maintains records of all checks issued and can reissue checks in some circumstances.
Checks may have been returned as undeliverable if you moved. The administrator typically attempts to locate class members but cannot always do so.
Uncashed checks eventually expire. After the expiration period, funds may be redistributed to other class members or handled according to the settlement agreement’s cy pres provisions.
What to Do About a Missing Check
| Situation | Action |
|---|---|
| Moved since filing | Update your address with the administrator |
| Check lost in mail | Request a stop payment and reissue |
| Check expired | Ask about the reissue window |
| Never received any notice | Verify your claim was actually accepted |
| Payment went to old account | Contact the administrator immediately |
Time limits apply to check reissue requests. The settlement agreement includes deadlines for claiming uncashed funds. Do not delay if you think you are owed money.
Reality Check
No one from the settlement administrator will text you a link to claim your Capital One settlement payment. The official process uses the settlement website and U.S. mail. You never have to pay a fee to receive a class action settlement payment. If someone asks for your bank password, a “processing fee,” or gift cards to release your payment, it is a scam. The settlement administrator’s contact information is available on the official settlement website, and that is the only source you should trust.
What Security Commitments Did Capital One Make in the Settlement?
Capital One made security commitments as part of the settlement. These commitments were designed to prevent a similar breach from occurring.
The company agreed to implement specific security measures, including enhanced encryption, improved firewall configurations, and regular security audits. Some of these measures were already underway before the settlement.
The settlement included these commitments as non-monetary relief. They were part of the total value of the settlement alongside the $190 million cash fund.
Security Commitment Areas
| Commitment | Purpose |
|---|---|
| Enhanced encryption | Protect stored customer data |
| Firewall configuration reviews | Prevent misconfiguration vulnerabilities |
| Regular security audits | Identify weaknesses before exploitation |
| Employee security training | Reduce human error risk |
| Third-party access controls | Limit external vendor exposure |
These commitments apply to Capital One’s operations. They do not directly benefit individual class members in a financial sense but provide broader protection for current and future customers.
Are There Other Capital One Data Breach Lawsuits?
The main Capital One data breach class action is settled. Other related lawsuits, including derivative actions brought by shareholders, have generally been resolved or dismissed.
Regulatory actions have also concluded. The Office of the Comptroller of the Currency fined Capital One $80 million in 2020. The Federal Reserve took no public enforcement action related specifically to the breach.
Individual lawsuits by class members who opted out of the settlement may still exist. Those cases would proceed separately and are not part of the $190 million settlement.
Related Legal Actions
| Action Type | Status |
|---|---|
| Consumer class action | Settled for $190 million |
| Canadian class action | Settled separately |
| Shareholder derivative suits | Resolved or dismissed |
| OCC enforcement | $80 million fine paid |
| Criminal prosecution | Conviction secured |
What Happens Next
August 2026 to December 2026: The settlement administrator continues processing remaining valid claims and addressing reissue requests.
Late 2026: Any remaining uncashed check processes continue under the settlement agreement’s terms.
2027: Final distribution reporting to the court may occur as the settlement winds down.
Ongoing: Class members who filed valid claims can continue checking payment status through the official settlement website.
Closed: New claims are no longer accepted. The claim deadline of September 30, 2022, remains in effect.
Frequently Asked Questions
Is the Capital One settlement still open for claims?
No, the claim deadline was September 30, 2022.
New claims are not being accepted as of 2026.
The settlement is in distribution, not claim filing.
How much was the Capital One data breach settlement?
The settlement fund was $190 million.
Individual payments varied based on claim type and documentation.
Out-of-pocket losses could be reimbursed up to $25,000.
Who got money from the Capital One settlement?
Class members who filed valid claims by the deadline got payments.
Claimants with documented losses generally received more than those who filed only for lost time.
Payment amounts varied widely across the class.
What if I was affected by the Capital One breach but never filed?
If you never filed by September 30, 2022, you likely cannot file now.
The claim deadline has passed and no late filing window is open.
You may still benefit from the security commitments Capital One made.
How do I contact the Capital One settlement administrator?
The settlement administrator is Epiq Class Action & Claims Solutions.
Contact information is on the official settlement website.
Do not use phone numbers or websites from unsolicited text messages or emails.
Was the Capital One settlement tax deductible?
Settlement payments for personal losses are generally not taxable income.
Reimbursement for actual losses is a return of your own money.
Consult a tax professional for advice specific to your situation.
Did Capital One offer free credit monitoring after the breach?
Yes, Capital One offered free credit monitoring and identity protection services.
The offer was made to affected individuals following the breach announcement.
The settlement also provided for restoration services.
What was the Capital One breach in simple terms?
A hacker accessed personal information stored on a cloud server.
The data came from credit card applications and accounts.
About 98 million U.S. consumers were affected.
