How much can you get from a data breach settlement?

Data breaches are becoming increasingly common, with millions of Americans having their personal information exposed each year. When a company suffers a data breach and exposes its customers’ private data, those affected may be eligible for compensation through a class action settlement. But how much money can you really expect to receive from a data breach settlement? Here’s what you need to know.

What is a data breach class action lawsuit?

A data breach class action lawsuit is when a group of people affected by the same data breach join together and sue the company responsible. They claim the company failed to adequately protect their personal information. If the lawsuit is successful, those affected may be eligible for a cash payment or other compensation as part of a class action settlement.

Some of the largest data breaches that have resulted in class action settlements include:

• Equifax – Exposed information of 147 million people in 2017
• Yahoo – Exposed information of 3 billion users over three data breaches
• Anthem – Exposed data of 79 million people in 2015
• Home Depot – Exposed data of 50 million people in 2014

The plaintiffs in these lawsuits alleged the companies failed to implement reasonable data security safeguards, allowing hackers to access sensitive information like Social Security numbers, birthdates, addresses, and credit card details.

How much money could I get from a settlement?

The amount you could receive from a data breach settlement varies greatly depending on the specific case. It depends on factors like:

• How many people were affected – The more people affected, the less each individual is likely to receive.
• What types of information were exposed – More sensitive breaches involving financial information may result in larger settlements.
• How much the company earns – Larger companies with bigger profits can generally pay out more in a settlement.
• How strong the evidence is – Strong evidence proving the company’s negligence usually results in a larger settlement.

In most cases, however, each person affected by a data breach receives only a small amount from the settlement – often less than $100. Some of the largest data breach settlements paid out the following amounts:

As you can see, most data breach settlements result in relatively small payouts of under $100 per person affected. The settlements aim to compensate people for the time spent dealing with the breach, not necessarily cover significant financial losses.

What factors determine how much I could get?

The main factors that determine payout amounts from a data breach settlement include:

• Type of information exposed – If sensitive information like Social Security numbers, financial data, or medical records were compromised, the settlement amounts tend to be higher since this data can be used for identity theft and fraud.
• Number of people affected – The more people impacted by the breach, the lower the potential payouts for each individual. Legal fees get distributed across all claimants.
• Actual misuse – People who had their information directly misused for fraud or identity theft may receive higher settlement amounts.
• Strength of the case – Clear evidence showing the company acted negligently results in higher settlements.
• Company size and revenue – Larger companies with bigger profits tend to pay out more in damages.

Additionally, the amount you personally receive depends on whether you submit a valid claim form during the claims process. Not everyone affected by a breach chooses to file a claim.

What expenses can a settlement cover?

The cash payments from data breach settlements are meant to reimburse expenses the breach may have caused, such as:

• Cost of credit monitoring and identity theft protection services
• Cost of freezing or unfreezing your credit reports
• Fees associated with account closures or credit card replacements
• Expenses related to identity theft resulting from the breach
• Lost time dealing with breach-related issues

That said, with most settlements being less than $100 per person, the amount likely won’t come close to covering any significant financial losses or inconveniences.

How long does it take to receive a payment?

It typically takes 1-3 years for a data breach settlement to be finalized and payments distributed. The process includes these general steps:

1. Class action lawsuit is filed following the breach.
2. The court rules on class certification to allowed a grouped lawsuit.
3. The case proceeds through the litigation process.
4. A settlement is reached or the case goes to trial.
5. The court approves the final settlement.
6. A claims administrator is appointed to oversee payouts.
7. Affected individuals submit valid claim forms.
8. Payments are distributed to approved claimants.

This multi-year process means payments usually come long after a breach occurs. Given the hassle of submitting claim forms, some people choose not to file at all since the amount is often small.

Can I opt out and sue the company individually?

When a class action settlement is proposed, people affected usually receive a notice with the option to exclude themselves or “opt out” of the settlement. Opting out allows you to retain the right to sue the company individually over the data breach.

However, there are some drawbacks to opting out:

• You’ll need to hire and pay for your own lawyer rather than having the class action attorneys represent you.
• You’ll have to gather substantial evidence that you were personally impacted.
• It takes time and money to pursue individual litigation that may go on for years.
• The company has more resources so your changes of winning could be lower.

Because of these obstacles, most individuals choose to stay part of the class action and receive a small automatic payment rather than opting out and pursuing their own case.

Should I get a lawyer to help with a data breach claim?

Having a lawyer can help maximize the settlement amount you receive from a data breach class action. An attorney can advise you on:

• Ensuring you take the necessary steps to file a valid claim.
• Collecting evidence like receipts and documentation if your information was misused.
• Communicating with the claims administrator if your claim is initially denied.
• Negotiating a larger compensation amount if your losses were extensive.

However, most lawyers won’t take on individual data breach cases unless losses are significant since the settlement amounts tend to be low. For basic claims, you may not need an attorney given the straightforward claims process.

Are there tax implications for payment amounts?

In most cases, the small amounts paid out from data breach settlements are not taxable:

• Payments meant to compensate for identity theft losses are not taxable.
• Reimbursements for credit monitoring and prevention costs are also not taxable.
• Payments for lost time and inconvenience are generally tax exempt as well.

However, if the settlement specifically allocates part of the payment as punitive damages against the company, that portion may be considered taxable income. Talk to a tax professional to be sure, but individuals are unlikely to face any tax bills from a small data breach settlement payment.

Key Takeaways

• Class action lawsuits allow groups impacted by a data breach to sue the responsible company.
• Settlement amounts typically range from $15 to $125 per person affected.
• Larger settlements are more common when sensitive data was exposed or identity theft resulted.
• It can take 1 to 3 years to receive payment from a data breach settlement.
• Individuals can opt-out and hire a lawyer to sue independently but this is uncommon.
• Settlement payments are designed to cover breach-related expenses and losses.

The Bottom Line

If your information was exposed in a data breach, joining a class action can result in a small amount of compensation with minimal effort on your part. Just don’t expect any massive windfall, given that most payments only amount to $100 or less per person affected.