Data breach settlements: what to claim

A data breach notification is followed by two things: a period in which nothing appears to happen, and, sometimes years later, a settlement with a claim form. Knowing what that form will ask for changes what you should be keeping now.

First, the distinction that matters

A lawsuit being filed is not a settlement. Class actions are filed within weeks of a large breach, and they contain allegations that have not been tested. There is no claim form, no money and often no resolution for years. A settlement is a court-approved agreement, reached later, with a claim form and a deadline.

The data breach tracker marks which stage each case has reached, because the confusion between the two is what scam claim sites exploit.

What these settlements typically pay for

Documented out-of-pocket losses. The core category. Bank or card fees caused by fraudulent charges, the cost of replacing a card, credit monitoring or identity protection you bought yourself after the breach, postage, notarization, and fees paid to place or lift a credit freeze where those were charged. Documented losses are usually reimbursable up to a cap set by the agreement.

Time. Many settlements pay for time spent dealing with the breach, at a set hourly rate and capped at a small number of hours. Some require a short description of what the time was spent on; a few require documentation.

A flat alternative payment. For class members with no documented loss, a small fixed sum, claimable on attestation. This is what most people receive.

Credit monitoring or identity protection. Usually offered in addition to money, for one to three years, activated through a code the administrator sends. It has real value if you are not already covered.

Extraordinary losses. Where actual identity theft followed, some settlements have a higher tier with a larger cap and a heavier documentation requirement: police reports, correspondence with banks, records of the fraudulent accounts.

What they do not pay for

Distress in the abstract, without documented consequence. Speculative future harm. Losses you were already reimbursed for by the bank, which is why fraudulent charges refunded by a card issuer are generally not claimable, though the fees around them may be.

What to keep, starting the day you are notified

The notification letter itself, which is normally accepted as proof of class membership and is the single most useful document. Then a folder: statements showing any fee or fraudulent charge, receipts for monitoring services, and a dated note of time spent, with what it was spent on. Two years later that folder is the difference between a documented claim and a flat payment.

Do the free things immediately, regardless of any settlement

Freeze your credit with the three national bureaus. It is free, it is the single most effective step against new-account fraud, and it has nothing to do with any settlement. The FTC's IdentityTheft.gov walks through freezing, fraud alerts and recovery if something has already happened.

If the breach involved a company the FTC has acted against, there may also be a government refund running in parallel, on a separate track from any class action. The Ring case, where the FTC alleged privacy failures let employees access customer video and left accounts open to attackers, is an example of the agency route producing payments directly.

When the claim form arrives

Read the tiers, claim the one you can stand behind, and keep the confirmation. Proof of purchase and no-proof claims covers what is accepted, and how to file a settlement claim without being scammed covers confirming the site is real before you upload identity documents to it, which in a breach settlement is an obvious irony worth avoiding.