Cybersecurity Settlement Analysis: Regulators, Fines, and Payouts

Cybersecurity settlement amounts span an enormous range, from the $5 billion the FTC extracted from Facebook in 2019 down to per-person class action payouts under a dollar, with a busy middle tier of state regulator fines in the tens of millions and federal fraud recoveries in the single-digit millions.¹ What a company pays depends heavily on who is bringing the case: federal regulators, state attorneys general, shareholders, consumers, or whistleblowers under the False Claims Act. Each channel produces different numbers, and the gap between the headline figure and what any individual receives is often the most important part of the story.

The Largest Privacy and Breach Settlements on Record

Facebook’s $5 billion FTC fine over Cambridge Analytica remains the single largest U.S. privacy enforcement action ever imposed on a company.¹²³

European regulators have driven several of the biggest recent numbers. Ireland’s Data Protection Commission fined Meta $1.3 billion in 2023 for transferring EU user data to the United States without adequate safeguards, hit TikTok with a $600 million fine in May 2025 for sending European user data to China, and imposed a $335 million fine on LinkedIn in October 2024 for processing user data for targeted advertising without proper consent. Amazon paid $877 million to Luxembourg authorities in 2021 for GDPR violations tied to behavioral advertising.⁴

On the consumer class action side, T-Mobile agreed to a $350 million settlement in 2022 after a breach exposed the data of 77 million customers, plus $150 million in cybersecurity improvements; final court approval came in June 2023, and payment distribution completed by May 2025.⁴⁵ The Equifax settlement, reaching up to $700 million after the 2017 breach of 147 million records, is the benchmark U.S. consumer data breach resolution. Capital One paid $190 million to settle a class action over its 2019 breach affecting 100 million people.¹

Shareholder Settlements After a Breach

Data breaches increasingly produce a second wave of liability: securities class actions from shareholders alleging that the company failed to disclose vulnerabilities or misrepresented its security posture. Public companies experience an average 7.27% share price drop after a breach, and financial firms have seen 17% drops relative to the NASDAQ in the first 16 trading days after an incident.⁶

Three of the ten largest data breach securities class action settlements ever were finalized in 2024, totaling $560 million:

Alphabet settled for $350 million over allegations it failed to disclose a bug that gave third-party developers access to user data for more than three years.
Zoom paid $150 million to resolve claims it misrepresented the encryption level of its video calls.
Okta paid $60 million after investors alleged the company downplayed a Lapsus$ attack affecting 366 clients.⁶

The SEC’s July 2023 cybersecurity disclosure rules, which require public companies to report material incidents on Form 8-K within four business days of a materiality determination, are feeding the pipeline.⁷ Compliance has been uneven: within the first 100 days of the mandate, 73% of 8-K filings failed to state whether a breach had a material impact, and only one report included quantitative effects.⁶

SEC Enforcement Against Companies

The SEC’s highest-profile cybersecurity action, against SolarWinds and its CISO over the 2020 SUNBURST attack, ended without a monetary judgment. A Manhattan federal judge dismissed most of the SEC’s claims in July 2024, including all post-breach disclosure allegations, leaving a narrower set of pre-breach misrepresentation claims. The parties reached a settlement in principle in July 2025, and the SEC dismissed the case with prejudice on November 20, 2025.⁸⁹¹⁰

The SEC also charged four public companies in October 2024 with materially misleading disclosures about their exposure to the SolarWinds compromise. Each described its risks in generic or hypothetical terms despite knowing it had been affected. Penalties were modest: $4 million for Unisys, $1 million for Avaya, $995,000 for Check Point, and $990,000 for Mimecast, all settled without admissions.¹¹⁸

DOJ Cyber-Fraud Recoveries From Federal Contractors

The Department of Justice’s Civil Cyber-Fraud Initiative, launched in October 2021, uses the False Claims Act against contractors and grant recipients that misrepresent their cybersecurity practices or fail to meet contractual security requirements. Recoveries topped $52 million in fiscal year 2025, more than triple the previous two years combined, across 15 settlements since inception (nine involving Department of Defense requirements).¹²¹³

Recent settlements show the range of amounts and theories in play:

Hill Associates, a Maryland IT company, paid $14.75 million in 2025 to resolve allegations of billing federal agencies for unqualified IT personnel and unauthorized cybersecurity services under its GSA contract between 2018 and 2023.¹⁴
Raytheon, RTX Corporation, and Nightwing Group collectively paid $8.4 million in May 2025 over Raytheon’s failure to implement a required system security plan on an internal development system used for 29 DoD contracts from 2015 to 2021. Nightwing, which acquired the business unit in 2024, was held liable as a successor for pre-acquisition failures. The whistleblower, a former Raytheon engineering director, received $1.5 million.¹⁵
MORSE Corp settled for $4.6 million in March 2025 after a whistleblower exposed the company’s failure to implement NIST SP 800-171 controls. MORSE had reported a compliance score of 104 in January 2021; an internal review later found it had implemented only 22% of required controls, for a true score of negative 142.¹⁶
Georgia Tech Research Corporation settled for $875,000 in October 2025 over similar allegations of missing anti-virus tools and a false assessment score.¹⁷
The Aero Turbine settlement in July 2025 held private equity firm Gallant Capital Partners liable alongside its portfolio company for $1.75 million, signaling scrutiny of passive investors.¹⁷

In December 2025, a federal grand jury indicted a former senior manager of a government contractor for fraud related to misleading agencies about FedRAMP compliance, marking a shift from civil to criminal cyber-fraud enforcement.¹⁷

FTC Fines and Consent Orders

The FTC uses its authority under Section 5 of the FTC Act to pursue “unfair or deceptive” security and privacy practices, and its consent orders typically last 20 years and require comprehensive information security programs with third-party assessments.¹⁸

Recent monetary actions include a $20 million settlement in January 2025 with Cognosphere over allegations that “Genshin Impact” violated the Children’s Online Privacy Protection Act, and a court-approved $10 million COPPA settlement in December 2025 against a media company over child-directed YouTube videos.¹⁹²⁰ The FTC also finalized a consent order against GoDaddy in May 2025 over allegations that the company falsely marketed “award-winning security” while failing to implement multi-factor authentication and security monitoring; the order requires a comprehensive security program with biennial independent assessments for 20 years.²¹

State Regulator Settlements

Twenty states had active consumer privacy statutes as of January 1, 2026, and a bipartisan consortium of attorneys general from California, Oregon, Colorado, Connecticut, and five other states now shares investigative resources.¹⁹

New York DFS

New York’s Department of Financial Services has entered consent orders with 27 entities totaling over $144 million in fines under its cybersecurity regulation, 23 NYCRR Part 500.²³²⁴²⁵

California and Multi-State Actions

The California Privacy Protection Agency issued its first enforcement actions in 2025, with a $1.35 million fine against Tractor Supply Company for failing to honor opt-out preference signals, maintain an adequate privacy policy, and put required contracts in place with third-party data recipients.²⁶ The California Attorney General reached a $93 million settlement with Google in 2023 over deceptive location tracking and a $2.75 million settlement with Disney in 2026 over opt-out failures across streaming platforms.²⁷

Multi-state coalitions produce their own settlements. The Target breach settlement in 2017 involved 47 states and D.C. and totaled $18.5 million. Illuminate Education settled with California, Connecticut, and New York for $5.1 million in November 2025 over a breach that exposed millions of student records.²⁷¹⁹

What Individual Consumers Actually Receive

The gap between headline settlements and per-person payouts is stark. An analysis of major U.S. settlements from 2018 to 2021 found per-member values ranging from $0.61 in the Yahoo breach litigation to $5.74 in a Quest Diagnostics case. Equifax paid roughly $2.59 per affected person, Anthem about $1.45, and Home Depot just $0.52. T-Mobile’s $350 million fund covered 76.6 million class members, or roughly $4.56 per person.²⁸

Class size is the biggest driver. A smaller case involving about 69,000 affected individuals yielded $12.65 per person, while classes in the tens or hundreds of millions dilute funds dramatically. Attorneys’ fees, typically around 30% of the settlement, further reduce what reaches claimants. Some settlements set a fixed aggregate fund; others provide per-claimant payments based on documented losses, with amounts up to $300 for general claims and $3,000 for extraordinary losses in certain cases.²⁸²⁹

Where Settlement Activity Is Heading

Litigation is broadening beyond breach cases into “non-attack” claims targeting routine ad-tech tracking and cookie deployment, often under decades-old wiretap and video privacy statutes.³⁰ In the EU, courts are weighing whether “loss of control” over personal data alone can support GDPR damages, and litigation funders are bundling individual privacy claims into mass proceedings.³¹

CISA continues to develop mandatory incident reporting rules for critical infrastructure under the Cyber Incident Reporting for Critical Infrastructure Act of 2022, though finalization has slipped past original targets.³²¹⁹¹³³³⁶

1
Enzuzo. Biggest Data Breach Fines
2
Texas Attorney General. Attorney General Ken Paxton Secures $1.4 Billion Settlement With Meta
3
Governing. Meta to Pay Texas $1.4B for Using Facial Recognition Without Users’ Consent
4
CSO Online. The Biggest Data Breach Fines, Penalties, and Settlements So Far
5
Keller Rohrback. T-Mobile 2021 Data Breach
6
Harvard Law School Forum on Corporate Governance. Data Breach Securities Class Actions: Record Settlements and Investor Claims on the Rise
7
SEC. Cybersecurity Disclosure
8
Harvard Law School Forum on Corporate Governance. Key Takeaways From Recent SEC Cybersecurity Enforcement Actions
9
U.S. District Court for the Southern District of New York. SEC v. SolarWinds Corp., Opinion and Order
10
Parker Poe. Key Takeaways for Companies After SEC Voluntarily Dismisses
11
SEC. SEC Charges Four Companies With Misleading Cyber Disclosures
12
Jackson Lewis. DOJ Announces All-Time High False Claims Act Recoveries
13
Akin Gump. Top DOJ False Claims Act Official Confirms Significant Upward Trajectory in Cybersecurity Enforcement
14
U.S. Department of Justice. Maryland IT Company Agrees to Pay $14.75M to Resolve Alleged False Claims
15
U.S. Department of Justice. Raytheon Companies and Nightwing Group Pay $8.4M to Resolve False Claims Act Allegations
16
Alston & Bird. DOJ Settles False Claims Act Case With MORSECorp Over Cybersecurity Program
17
Mintz. Cybersecurity-Related Enforcement Under the False Claims Act
18
Atlantic Council. Reasonable Cybersecurity in Forty-Seven Cases
19
White & Case. Privacy and Cybersecurity 2025-2026: Insights, Challenges, and Trends Ahead
20
FTC. Privacy and Security Enforcement
21
FTC. Federal Trade Commission Demonstrates Focus on Privacy and Data Security in 2024
23
NYDFS. DFS Announces Settlements Totaling Over $19 Million With Eight Auto Insurance Companies
24
Reversec. NYDFS Part 500 Cybersecurity Enforcement
25
Pillsbury. NYDFS Cybersecurity
26
CPPA. CPPA Enforcement Action Against Tractor Supply Company
27
California Attorney General. Privacy Enforcement Actions
28
Directors & Boards. What Boards Need to Know About Data Breach Class Actions
29
Edgeworth Economics. Value of Personal Information in Data Breach Class Actions
30
Law360. Privacy Cybersecurity Litigation to Watch in 2026
31
Freshfields. 2026 Data Law Trends
32
Wiley. CISA Reopens Comment Opportunity on Cyber Incident Reporting Requirements
33
Moody’s. D&O Series: Evolving Risks in the Boardroom