As of July 2026, 59 data breach class action settlements are open and accepting consumer claims, according to ClassAction.org's live settlement tracker, and $5,000 is the single most common individual payout cap, appearing in 41% of them. That is only the current snapshot. The seven largest confirmed settlements in US history, from Home Depot's 2016 case to T-Mobile's 2022 case, together total more than $1.39 billion, and the 2023 MOVEit breach is still spinning off new suits three years after the fact.
How many data breach class action settlements are open right now?
59, according to ClassAction.org's list of active settlements accessed in late July 2026. That tracker covers cases the site is actively promoting for consumer claims, mostly smaller regional breaches at credit unions, healthcare providers, and mid-size employers rather than the household-name mega-breaches that make headlines. It is a snapshot of one settlement-tracking site's listings, not a government-maintained or audited count of every data breach class action in the country, and the number shifts daily as new deals open and older ones close.
Figure 1: The number of data breach class action settlements listed as open for consumer claims on ClassAction.org, accessed July 2026.
ClassAction.org has a direct commercial interest in this traffic. Like most class-action settlement trackers, the site earns referral revenue by directing visitors toward participating law firms and claims administrators, so its listing skews toward settlements actively soliciting claimants rather than the full universe of resolved cases. It does not publish a fixed total industry count or a disclosed sample size beyond what is visible on the page itself. Treat the 59 figure as a real, counted snapshot of what one active tracker showed on one day, not a scientific census.
Even with that caveat, the raw volume is a useful signal. Fifty-nine simultaneous open settlements means the average business reading this is more likely than not to be sitting on a customer list that overlaps with at least one of them.
What is the largest data breach class action settlement in US history?
Equifax's 2019 settlement remains the record holder at $575 million total, according to Wikipedia's sourced account of the case, which cites the Federal Trade Commission, the Consumer Financial Protection Bureau, and 48 states and territories as co-parties. Of that total, $300 million was set aside specifically as a consumer compensation fund, $175 million went to the states and territories involved, and $100 million was a CFPB fine, covering 147.9 million affected Americans from the company's 2017 breach.
Figure 2: Total settlement obligation for the seven largest confirmed US data breach class action settlements. Source: figures compiled from each case's public record, see Sources below.
T-Mobile's $350 million settlement, agreed in 2022 over its 2021 breach and covering roughly 76 million customers, is the second largest and the largest single fund not split with a regulator. Capital One's $190 million 2022 settlement, resolving its 2019 breach that exposed 106 million people across the US and Canada, is third. Together, these seven named settlements alone total $1.397 billion in disclosed obligations, a figure that undercounts the true industry total because it excludes every smaller settlement, every case still in litigation, and every settlement whose terms were never made public.
You can generate a privacy policy that documents your breach-notification practices as one concrete step toward reducing the disclosure gaps that show up repeatedly in these lawsuits' underlying complaints. For the broader picture of how many breaches happen each year and what they cost companies to contain in the first place, see our companion post on data breach counts and costs.
How much does a typical data breach settlement pay per person in 2026?
Among the 59 open settlements ClassAction.org listed in July 2026, individual payout caps cluster heavily around one number. $5,000 is the maximum an eligible claimant can receive in 24 of the 59 listings, or 41%, making it the single most common ceiling by a wide margin. Actual per-person amounts depend on how many people file valid claims and how much documentation they provide, so most claimants receive far less than the advertised cap.
Figure 3: Distribution of the maximum individual payout cap across 59 open data breach class action settlements. Source: ClassAction.org settlement listings, accessed July 2026.
The floor is far less consistent than the ceiling. Documented-loss reimbursements in the 59 listings start as low as $25 to $150 per claim, while undocumented, self-certified losses typically cap out much lower, often a flat amount well under $1,000. A handful of settlements set no fixed per-claimant number at all, instead splitting a fixed pool proportionally among however many people file, the same structure our companion post on what data breach settlements actually pay per person found in several of the largest historical cases.
Is the 2023 MOVEit breach still generating new class actions?
Yes. Two of the 59 open settlements in ClassAction.org's July 2026 listing, tied to Ernst & Young and Greater Rochester IPA, trace directly back to the May 2023 MOVEit Transfer vulnerability, more than three years after Progress Software first disclosed it. MOVEit was not a single company's breach; it was a file-transfer tool used by thousands of organizations, so one vulnerability produced a long tail of separate downstream lawsuits as each affected customer's data surfaced in a different notification.
Figure 4: Why one 2023 vulnerability keeps producing new settlements years later. Source: case pattern observed across ClassAction.org's MOVEit-related listings, accessed July 2026.
That pattern is a preview of what to expect from other mass-breach incidents affecting shared vendors and platforms. A single upstream vulnerability does not resolve in one lawsuit; it resolves in dozens, spread out over years, as each downstream organization works through its own notification and litigation timeline separately.
How long does it take a data breach class action to reach a settlement?
Years, typically, and the gap between breach and settlement varies widely. Among five major cases with both dates publicly confirmed, the shortest gap was about one year, T-Mobile's 2021 breach settled in 2022, and the longest was roughly six years, Yahoo's breaches from 2013 and 2014 were not fully settled until 2019.
Figure 5: Time elapsed between a confirmed breach and its class action settlement, five major US cases. Source: figures compiled from each case's public record, see Sources below.
| Company | Breach year | Settlement year | Amount |
|---|---|---|---|
| Home Depot | 2014 | 2016 | $19.5M |
| Anthem | 2015 | 2017 | $115M |
| Yahoo | 2013 to 2014 | 2019 | $117.5M |
| Equifax | 2017 | 2019 | $575M |
| Capital One | 2019 | 2022 | $190M |
| T-Mobile | 2021 | 2022 | $350M |
| 23andMe | 2023 | 2024 | $30M |
Some of the largest recent breaches by population have not reached a settlement at all yet. The 2024 Change Healthcare ransomware attack affected an estimated 190 million people, more than any case in the table above, but as of its December 2024 multidistrict litigation consolidation, no settlement fund total had been finalized. A newer wave of open settlements listed by ClassAction.org in July 2026, including Nissan, TikTok, and Madison Square Garden class actions filed earlier in 2026, shows that pipeline refilling continuously rather than slowing down.
A settlement this size is rarely paid entirely out of a company's operating budget; see our companion post on cyber insurance premiums and claim payout rates for how often a cyber policy actually covers the bill.
The Bottom Line
Fifty-nine open settlements at once is not a lull in data breach litigation; it is closer to the steady state. The seven largest confirmed settlements alone account for close to $1.4 billion in disclosed obligations, and the volume of new filings ClassAction.org tracked in 2026, spanning industries from healthcare to retail to entertainment, shows no sign of slowing. Most individual claimants will still see a payout far closer to the $5,000-or-under cap that dominates the current listings than to a headline settlement total in the hundreds of millions, and the MOVEit example shows that a single vendor vulnerability can keep producing new cases years after the original disclosure. For a business handling personal data, the practical takeaway is the same one these lawsuits keep repeating in their underlying complaints: a current, specific privacy policy that documents data retention and breach-notification practices is a cheap, direct way to reduce exposure well before litigation ever becomes a question.
Frequently Asked Questions
How many data breach class action settlements are open right now? 59, as of July 2026, according to ClassAction.org's live settlement tracker, which lists currently active data breach settlements accepting consumer claims. That count is a snapshot of one tracker's listings, not an audited industry-wide census, and it changes daily as new settlements open and older ones close.
What is the largest data breach class action settlement in US history? Equifax's 2019 settlement, at $575 million total, of which $300 million was earmarked specifically for consumer compensation, $175 million went to states and territories, and $100 million was a CFPB fine. It covered 147.9 million affected Americans, per Wikipedia's sourced account of the case.
How much does a typical data breach settlement pay per person in 2026? Among the 59 open settlements ClassAction.org listed in July 2026, $5,000 was the single most common maximum individual payout, appearing in 24 of them, or 41%. Most set a floor between $25 and $150 for undocumented losses, with higher amounts requiring receipts or proof of loss.
Is the 2023 MOVEit breach still generating new class actions? Yes. Two of the 59 open settlements ClassAction.org listed in July 2026, tied to Ernst & Young and Greater Rochester IPA, trace back to the May 2023 MOVEit Transfer vulnerability, which continues to surface in new downstream settlements more than three years after the original incident.
Where the Numbers Come From
- ClassAction.org. Live settlements tracker, accessed July 2026. Listed 59 open data breach settlements, including their individual payout ranges and claim deadlines; the site does not disclose a fixed total industry count or a formal sampling methodology, and earns referral revenue from the law firms and claims administrators it links to.
- Wikipedia. "2017 Equifax Data Breach." Cites the $575 million total settlement ($300 million consumer fund, $175 million to states and territories, $100 million CFPB fine) and 147.9 million affected Americans.
- Wikipedia. "T-Mobile Data Breach." Cites the $350 million 2022 class action settlement over the 2021 breach.
- Wikipedia. "Capital One Financial." Cites the 2019 breach affecting 106 million people in the US and Canada; the $190 million 2022 settlement figure is drawn from ClassAction.org's case listing.
- Wikipedia. "Yahoo! Data Breaches." Cites the $117.5 million settlement approved in April 2019.
- Wikipedia. "Anthem Medical Data Breach." Cites the $115 million 2017 settlement and 78.8 million affected people.
- Wikipedia. "Home Depot Data Breach." Cites the $19.5 million 2016 settlement and more than 50 million affected consumers.
- Wikipedia. "23andMe Data Leak." Cites the $30 million settlement agreed in September 2024 and 6.9 million affected user profiles.
Note: All figures verified as of July 2026. The 59-open-settlements count and the $5,000 payout-cap distribution reflect a single live tracker's listings on the access date and will shift as new settlements open and close; the seven named mega-settlement dollar figures are independently corroborated through Wikipedia's court-record-sourced summaries of each case.
