Received a Data Breach Notification Letter? Here's What to Do (And How to Claim Money)

You opened your mail and found a letter from a company informing you that your personal information was exposed in a data breach. Or maybe an email arrived with the subject line "Important Notice Regarding Your Account Security." Your first question is probably: what do I do now? Your second should be: can I file a claim?

The answer to both is yes — and this guide walks you through exactly what steps to take.

Why Did You Receive This Letter?

Data breach notification laws exist in all 50 U.S. states. When a company discovers that personal information was exposed — through a hack, insider theft, or security vulnerability — they're legally required to notify affected individuals within a set timeframe (typically 30-90 days of discovering the breach).

The letter you received means the company knows your data was part of the exposure. It's not spam. It's not a scam. It's a legal obligation on their part.

Information commonly exposed in data breaches includes:

• Name and contact information
• Social Security numbers
• Financial account numbers
• Login credentials (usernames and passwords)
• Medical records and health insurance information
• Driver's license numbers
• Payment card information

Immediate Steps to Take After a Breach Notification

Step 1 — Read the Letter Carefully

The notification letter must tell you: what type of information was exposed, when the breach occurred (approximately), and what the company is doing in response. Note the company name, incident date, and exactly what data was compromised. You'll need this later for any claims.

Step 2 — Change Your Passwords

If login credentials were exposed, change your password immediately — not just on the breached service, but on any other account where you use the same password. Enable two-factor authentication (2FA) where available.

Step 3 — Place a Credit Freeze

If Social Security numbers, financial accounts, or other identity-related data was exposed, place a credit freeze with all three major bureaus: Equifax, Experian, and TransUnion. A freeze is free and prevents new credit accounts from being opened in your name. You can temporarily lift it when you need credit.

Step 4 — Enroll in Any Free Monitoring Offered

Many breach notifications include an offer for free credit monitoring for 1-2 years. Accept it — it's free and helps you detect misuse quickly.

Can You File a Class Action Claim for a Data Breach?

Almost certainly, yes — if the breach was significant. Here's why: when a company suffers a major data breach, plaintiff's attorneys almost immediately begin investigating whether the company failed to meet its legal duty to protect your data. If they find evidence of negligence (inadequate security measures, failure to encrypt data, known vulnerabilities left unpatched), they file a class action on behalf of everyone affected.

If you received a breach notification letter, there's a high probability a class action has already been filed or is being pursued. The settlement might already be open for claims.

How to Find Out If There's a Settlement

Three ways to find data breach settlements:

1. Search SettlementRadar: Browse our data breach settlement directory and search for the company name that sent you the notification
2. Search "[Company Name] data breach settlement" online: If a settlement has been reached, you'll find news coverage and the official claims site
3. Check your email: Settlement administrators often email class members directly to notify them of open claims — sometimes months or years after the breach notification

Important: you don't need the original breach notification letter to file a claim. If you remember which company had the breach and can confirm basic eligibility, you can file.

What You Can Claim in a Data Breach Settlement

Data breach settlements typically offer multiple tiers of compensation:

Tier 1: Ordinary Claims (No Documentation Required)

A flat payment — often $50 to $150 — just for being a member of the affected class. This requires no documentation beyond confirming you had an account during the class period.

Tier 2: Out-of-Pocket Losses

Reimbursement for actual financial losses connected to the breach, including:

• Credit monitoring services you purchased
• Identity theft restoration costs
• Professional fees (attorneys, credit counselors)
• Fraudulent charges on accounts that weren't reimbursed
• Time spent dealing with identity theft consequences (usually compensated at $15-25/hour)

Tier 3: Documented Identity Theft or Fraud

If you can demonstrate that your identity was actually stolen or accounts were fraudulently opened as a result of the breach, some settlements provide significantly higher compensation — sometimes $2,500 to $5,000 or more.

Notable Data Breach Settlements to Know

Data breach litigation has produced some of the largest consumer settlements in history:

• Equifax Data Breach ($700M, 2019): The 2017 breach exposed SSNs and financial data of 147 million Americans. Claimants could receive credit monitoring or a cash payment. Check if this is still open for your region.
• T-Mobile Data Breach ($350M, 2022): Covered millions of current and former T-Mobile customers whose data was exposed in a 2021 breach. Claims paid up to $25,000 for documented identity theft.
• Yahoo Data Breach ($117.5M, 2019): Covered the massive breaches that affected Yahoo/AOL account holders between 2012 and 2016. If you had a Yahoo or AOL account during that period, you may have been eligible.
• Target Data Breach ($10M, 2015): One of the first major retail payment card breaches. Established the template for retail breach settlement structures that followed.

How Long Do You Have to File a Claim?

Data breach settlement claim deadlines vary but typically fall 90-180 days after the settlement is announced. Critically: the claims deadline is often 1-3 years after the actual breach, because litigation takes time.

This means: if you received a breach notification in 2023, a settlement might be accepting claims in 2025 or 2026. Check periodically, even for older breaches.

To stay on top of open deadlines, browse data breach settlements sorted by deadline.

What If the Breach Caused You Real Harm?

If you experienced actual identity theft, fraudulent accounts opened in your name, or significant financial harm that you can connect to a specific data breach, you have options beyond the class action settlement:

• File in the higher-value tier of the class action claim with documentation
• Consult an individual attorney about whether opting out of the class action and filing individually makes sense (this is rarely the right choice, but worth evaluating for large documented losses)
• Report to the FTC at IdentityTheft.gov to create an official record and get a recovery plan

Frequently Asked Questions

I received a breach notification 2 years ago — is it too late to file?

Maybe not. Class action settlements can be negotiated and approved long after the breach. Search for the company name at SettlementRadar — a settlement may still be open or may have recently opened.

What if I don't remember whether I had an account with the company?

If you received a breach notification letter, the company confirmed you were in their records. That's your eligibility confirmation. File the claim.

Do I need to prove my identity was stolen?

For the basic payment tier, no. You simply certify under penalty of perjury that you were an affected account holder. Documentation is only required for higher-value loss reimbursement tiers.

Can I file for multiple data breach settlements?

Yes. If your data was exposed in multiple breaches — which is extremely common — you can file separate claims for each applicable settlement.