Divide the total dollar amount of a US data breach class-action settlement by the number of people it covers, and the result lands under $5 per person in every one of six major cases resolved between 2016 and 2024: Home Depot, Anthem, Yahoo, Equifax, T-Mobile, and 23andMe. That is before legal fees, administrative costs, and a state or federal regulator's own cut are subtracted from the headline total, and before accounting for how many people actually file a claim at all.
This post lays out how each of those six settlements breaks down, why Equifax's headline $125 offer shrank so far past its advertised value, and where the rest of each settlement's total actually goes instead of into a claimant's pocket.
How much does a data breach settlement pay per person?
Not much, once the math is done. Across the five settlements where a fixed total fund and a fixed affected-population count are both publicly disclosed, dividing one by the other never crosses $5 per person.
Figure 1: Total settlement fund divided by the disclosed number of affected people, five major US data breach settlements. Source: settlement figures compiled from each case's public record, see Sources below.
That calculation is a simple division, not a promise of what any individual received. It uses each settlement's own disclosed total fund and disclosed class size, sorted here from the highest implied per-person figure to the lowest. Even the largest fund reviewed, T-Mobile's $350 million 2022 settlement, works out to about $4.61 per person once spread across the roughly 76 million customers it covers. The smallest, Home Depot's 2016 settlement, works out to $0.39 per person or less across the more than 50 million shoppers it affected. For the broader picture of how many breaches happen each year and what they cost companies to contain, see our companion post on data breach counts and costs.
The pattern holds regardless of company size or how sensitive the exposed data was: the fund-per-person math almost always lands in low single digits, not the three- or four-figure sums a headline settlement total might suggest.
Why did Equifax's advertised $125 payment shrink so far?
Equifax's 2019 settlement offered eligible consumers a choice: free credit monitoring, or up to $125 in cash for anyone who already had monitoring and did not want more. That $125 figure is the number most people remember from the case, and it is also the clearest public example of why a settlement's headline offer and its actual payout can differ sharply.
Equifax's own settlement website confirms what happened next. Because far more people filed for the $125 cash alternative than the $31 million pool the settlement had set aside for that option could support, the site states plainly that those payments "likely will be substantially lowered" and distributed on a proportional basis rather than paid in full. No single final dollar figure per approved claimant was published on the site as one fixed number, but the reduction mechanism itself is a matter of public record on the settlement's own FAQ page, not a rumor or a news report repeating an unverified figure.
Figure 2: Settlement fund divided by affected population, six major US data breach settlements, 2016 to 2024.
The lesson generalizes beyond Equifax. Any settlement that advertises a fixed dollar amount per person without capping the total number of possible claimants is really offering a share of a fixed pool, not a guaranteed price tag. The more people who file, the smaller each share becomes.
Where does the rest of a data breach settlement go?
A settlement's headline total is rarely the same number as what is set aside for consumer cash payments. Equifax's case makes this explicit because the components were broken out publicly: of the $575 million total settlement obligation, only $300 million, about 52.2%, was earmarked as a consumer compensation fund. The other $175 million went to the states and territories that were parties to the case, and $100 million went to the Consumer Financial Protection Bureau as a fine.
Figure 3: Where Equifax's $575 million total settlement obligation was allocated. Source: settlement terms as reported, see Sources below.
Home Depot's 2016 settlement shows the same split in miniature. Of its $19.5 million total, $13 million was set aside as a direct consumer reimbursement fund and a separate $6.5 million funded identity-protection services rather than cash, on top of a year of free credit monitoring through AllClear ID. Even reading a settlement's top-line dollar figure in a headline does not tell you what share of it, if any, a given claimant is eligible to receive in cash.
Does a bigger breach mean a bigger per-person payout?
Not consistently. The size of the affected population and the size of the settlement fund do not move together in a simple ratio, which is part of why the per-person figure swings between $0.39 and $4.61 across the cases with a calculable rate.
Figure 4: Why a settlement's headline total shrinks before it reaches an individual claimant.
| Company (settlement year) | Total fund | People affected | Fund per person |
|---|---|---|---|
| Home Depot (2016) | $19.5M | 50M+ | $0.39 |
| Anthem (2017) | $115M | 78.8M | $1.46 |
| Yahoo (2019) | $117.5M | ~194 to 200M | Not fixed* |
| Equifax (2019) | $300M (consumer share of $575M) | 147.9M | $2.03 |
| T-Mobile (2022) | $350M | ~76M | $4.61 |
| 23andMe (2024) | $30M | 6.9M | $4.35 |
*Yahoo's settlement offered credit monitoring plus a cash payout whose final size depended on the number of respondents in the class, so no single fixed per-person figure was ever published.
Yahoo's case is the clearest illustration of why the fund-per-person number is a ceiling, not a promise. Its $117.5 million total, spread across an estimated 194 to 200 million class members, works out to well under a dollar per person if divided evenly, but the actual settlement never divided it evenly in the first place. It paid credit monitoring to everyone eligible and a cash amount that scaled with how many people actually came forward.
Figure 5: Total settlement fund size across six major cases, ordered by year rather than value. Source: settlement figures compiled from each case's public record, see Sources below.
Settlement totals do not climb steadily year over year either. 23andMe's 2024 fund, at $30 million, is smaller than every other settlement reviewed here except Home Depot's, despite involving a more recent and, in some respects, more sensitive category of data: genetic ancestry information.
Are bigger settlements coming for the newest mega-breaches?
Some of the largest recent breaches by population have not reached a settlement fund at all yet. The 2024 Change Healthcare ransomware attack affected an estimated 190 million individuals, more than any single case in the comparison table above, but as of the litigation's consolidation into multidistrict litigation in December 2024, no settlement fund total had been finalized. A separate 2024 AT&T breach affecting around 110 million customers was also still working through litigation as of the sources reviewed for this post, with no confirmed settlement fund yet either.
Figure 6: Settlement milestones for six major cases, plus the still-unresolved Change Healthcare litigation. Source: settlement figures compiled from each case's public record, see Sources below.
That gap matters for anyone trying to predict what a future mega-breach will pay out. A larger affected population does not automatically produce a larger fund, and it can take years between a breach and a finalized settlement total, let alone an actual check mailed to claimants.
A related pattern worth tracking as this series grows: how the average cost per stolen record compares to what a settlement pays out per affected person, and how often a data breach settlement actually reaches class-action certification in the first place. Both questions are covered in companion posts in this series.
The Bottom Line
The headline dollar figure attached to a data breach settlement is almost never the number that lands in an individual claimant's pocket. Across six major US cases resolved between 2016 and 2024, dividing the total fund by the affected population never exceeds $4.61 per person, and Equifax's own settlement administrator has confirmed in writing that even an advertised fixed payment can shrink well below its stated value once enough people file a claim. Legal fees, state and federal regulator shares, and non-cash benefits like credit monitoring all take a piece of the total before any cash reaches a consumer.
Many of these lawsuits originated from allegations that a company failed to clearly disclose how it collected, stored, or protected personal data, or how it would respond if that data were exposed. A current, specific privacy policy that documents your data retention and breach-notification practices will not prevent every incident, but it is one of the cheapest, most direct ways to reduce that exposure. You can generate a privacy policy for your site that covers those disclosures directly.
Frequently Asked Questions
How much did Equifax data breach victims actually receive? Equifax's 2019 settlement advertised up to $125 in cash for consumers who already had credit monitoring. But the settlement's own administrator site confirms that because far more people filed for the $125 option than the $31 million set aside for it could cover, payments were substantially lowered and distributed proportionally instead of paid in full.
What is the largest data breach settlement fund on record among recent cases? Among the six major settlements reviewed here, T-Mobile's 2022 settlement set the largest total fund at $350 million, covering roughly 76 million affected customers. Larger breaches are still working through litigation: Change Healthcare's 2024 breach affected 190 million people, but as of the case's December 2024 multidistrict litigation consolidation, no settlement fund had been finalized.
Why do people get so little money from a data breach settlement? Because the headline total rarely all goes to consumers. Equifax's $575 million settlement obligation split into $300 million for consumer compensation, $175 million to states and territories, and a $100 million CFPB fine, meaning only 52.2% of the total was ever earmarked for the 147.9 million affected people.
Do all data breach settlements pay cash to every victim? No. Many settlements split the fund between direct cash and non-cash benefits like credit monitoring. Home Depot's 2016 settlement, for example, split its $19.5 million total into a $13 million consumer reimbursement fund and a separate $6.5 million fund for identity-protection services, covering more than 50 million shoppers.
Where the Numbers Come From
- Wikipedia. "2017 Equifax Data Breach." Cites the settlement's $300 million consumer compensation fund, $175 million to states and territories, $100 million CFPB fine (total $575 million), and 147.9 million affected Americans.
- Equifax Breach Settlement. Official settlement administrator site. States directly that payments for the $125 cash alternative and time-spent compensation "likely will be substantially lowered" and distributed proportionally because claim volume exceeded the funds set aside.
- Wikipedia. "T-Mobile Data Breach." Cites the $350 million 2022 class-action settlement and the scale of affected customers.
- Wikipedia. "Anthem Medical Data Breach." Cites the $115 million 2017 settlement and 78.8 million affected people.
- Wikipedia. "Home Depot Data Breach." Cites the $19.5 million 2016 settlement ($13 million reimbursement fund plus $6.5 million identity-protection fund) and more than 50 million affected consumers.
- Wikipedia. "Yahoo! Data Breaches." Cites the $117.5 million 2019 settlement, credit monitoring plus a variable cash payout, and an estimated 194 to 200 million class members.
- Wikipedia. "23andMe Data Leak." Cites the $30 million settlement agreed in September 2024 and 6.9 million affected user profiles.
- Wikipedia. "2024 Change Healthcare Ransomware Attack." Cites 190 million individuals affected and the December 2024 multidistrict litigation consolidation, with no settlement fund finalized as of that date.
Note: All figures verified as of July 2026. Several figures in this post are corroborated through Wikipedia's cited compilation of court filings and news coverage rather than a directly retrieved court document or FTC press release, because those primary-source domains returned access-blocked responses during this research pass; the Equifax settlement administrator's own site was retrieved and quoted directly. Settlement totals and claim outcomes are refreshed as new cases resolve or new distribution data is published.
