Am I Entitled to Compensation for a Data Breach?

The Two Paths to Compensation

1. Joining a class action settlement

If a lawsuit has been filed over the breach and a settlement reached, eligible class members can typically file a claim without needing to prove much beyond that their data was included in the breach.

2. Statutory damages under certain state laws

A handful of states — California is the clearest example — give consumers the right to sue directly and, in some circumstances, recover a fixed dollar amount per violation without having to prove you suffered a specific financial loss. This exists because lawmakers recognized that requiring proof of actual monetary harm from a data breach sets an unreasonably high bar — the harm from having your SSN exposed is real even before an identity thief actually uses it.

What Courts Look At

Historically, one of the biggest hurdles in data breach litigation has been "standing" — a legal requirement that a plaintiff show a concrete, actual injury, not just a hypothetical risk. Courts have taken different approaches to this over time, and it remains an evolving area of law. Generally, cases are on stronger footing when they can point to:

• Actual misuse of the data — fraudulent charges, new accounts opened, tax return fraud, and similar concrete harms
• Highly sensitive data types exposed — Social Security numbers and government ID numbers create a more direct, recognized risk than, say, an email address alone
• Time and money spent responding — credit monitoring costs, time spent freezing accounts and disputing charges, all count as a form of injury in many courts
• Delayed notification — the longer a company waited to tell you, the more concrete the "lost time to protect yourself" injury becomes, since courts increasingly recognize that lost window as its own harm, separate from the breach itself

State Law Makes a Real Difference

Because there's no single federal data breach law, your rights depend heavily on where you live:

• Some states allow only the state Attorney General to bring enforcement actions — meaning individual consumers can't sue directly under the notification statute itself, though they may still have other legal theories available (negligence, breach of contract, and so on).
• A smaller number of states — California being the most significant — give individual consumers a private right of action with statutory damages available for certain violations, which can significantly change the compensation picture.
• Some states have stricter, more specific security requirements for businesses handling residents' data, which can strengthen a negligence claim if a company failed to meet them.

See our full state-by-state breach notification law reference for what applies where you live.

Documented Losses vs. General Exposure

It's worth understanding the difference between these two categories, since they're often treated differently in a settlement:

General exposure — your data was in the breach, but you haven't experienced any specific fraud or misuse. This still typically qualifies for baseline compensation in most class settlements (often modest, sometimes paired with credit monitoring), and can qualify for statutory damages in states that allow it, but rarely qualifies for the largest payout tiers on its own.

Documented losses — you can show specific, out-of-pocket harm tied to the breach: a fraudulent charge, a new account opened in your name, fees paid to a credit monitoring or identity restoration service, hours spent on the phone with banks or credit bureaus. If you're in this category, keep records now — receipts, bank statements showing fraudulent charges, and a simple log of time spent responding. Settlements with a documented-loss tier typically require this kind of evidence to qualify for a larger payment, and it's much easier to gather contemporaneously than to reconstruct months later.

Check If You're Part of a Known Breach

Search by company name to see if a breach has been reported and what data types were involved.