A data breach settlement claim form is the document you submit to a court-appointed administrator to collect your share of a class action payout after a company exposed your personal information. Fill it out with accurate identifying details, attach documentation for any losses you’re claiming, and submit it through the official settlement website or by mail before the deadline printed on your notice. Filing correctly matters because sloppy forms get rejected, and because submitting one waives your right to sue the company on your own over the same breach.
What to Gather Before You Start
Every form asks for the same basics: full legal name, current mailing address, and email. Most settlements also assign a Class Member ID or Notice ID printed on the letter or email you received. That code links you to the administrator’s records and speeds verification. If you’ve moved since the breach, add your former address so the administrator can match you against the company’s files.
The form itself lives on the official settlement website, which is run by a third-party claims administrator. You can fill it out online or download a paper version. Enter everything carefully. Forms rejected during initial screening for typos or missing fields waste the deadline you’re working against, and resubmission isn’t always allowed once that date passes.
Documenting Your Losses
Most data breach settlements split financial claims into two buckets: out-of-pocket expenses and lost time.
Out-of-pocket expenses are money you actually spent because of the breach. That includes fees for credit reports or monitoring services you bought yourself, charges from professionals who helped resolve tax fraud, and costs to freeze or unfreeze your credit. The administrator wants receipts, billing statements, or invoices that clearly show dates and dollar amounts. Scan or photograph documents at a quality high enough that nothing is cut off or blurry.
Lost time covers hours spent dealing with the fallout: calling your bank, disputing unauthorized charges, monitoring accounts. Recent settlements have paid $25 to $30 per hour. The T-Mobile settlement paid $25 per hour for up to 15 hours of lost time tied to documented expenses, plus up to 5 additional hours of self-certified time.1T-Mobile Data Breach Settlement. Frequently Asked Questions The Equifax settlement paid $25 per hour for up to 20 hours.2Equifax Data Breach Settlement. FAQs The Comcast settlement went higher at $30 per hour for up to 5 hours. Each settlement sets its own rate and caps, so read your notice carefully.
For a few hours of self-certified time, a written description of what you did and when is usually enough. If you’re claiming more, expect to attach supporting documentation showing actual fraud or identity theft occurred. Even where proof isn’t strictly required, a dated log of the steps you took strengthens the claim.
The Attestation You’re Signing
Before you submit, you’ll hit an attestation declaring under penalty of perjury that everything on the form is true. That language is not decorative. Federal law treats a false statement signed under penalty of perjury the same as lying under oath, with potential penalties of up to five years in prison and a fine of up to $250,000.3Congress.gov. False Statements and Perjury: An Overview of Federal Criminal Law Prosecutors rarely pursue individual claimants for honest mistakes, but inflating losses or fabricating expenses is fraud. If you’re unsure about a number, look it up or leave that portion blank rather than guessing.
How to Submit
Online is the simplest path. Upload the completed form and supporting documents as PDFs through the settlement portal. You should receive a confirmation email with a claim reference number. Save it. That number is your proof of timely filing and the only way to track your claim’s status.
If you’d rather mail the form, send a paper copy to the address in the settlement notice. Use certified mail or ask for a certificate of mailing at the post office counter. A certificate of mailing is postmarked at the retail counter on the day USPS accepts your letter, giving you a dated receipt for when it was mailed.4United States Postal Service. Certificate of Mailing
This matters more than it used to. A USPS operational change means automated postmarks now show the date a letter was first processed at a regional facility, which may be a day or more after you actually dropped it in a collection box. If you’re mailing near the deadline, walk into a post office and get a manual postmark or certificate of mailing at the counter. That reflects the actual date USPS took possession of the letter.5Federal Register. Postmarks and Postal Possession
The filing deadline is a hard cutoff set by the court. Missing it almost always means you permanently lose any right to money from the settlement. There is no “good cause” exception for most class action claim deadlines. Put the date on your calendar the moment you receive the notice.
What You Give Up by Filing
The form doesn’t make this obvious enough: by staying in the class and filing a claim, you release the defendant from all related legal claims. You cannot later sue the company individually over the same breach, no matter how much your actual damages turn out to be. The final judgment in a class action binds every class member who didn’t affirmatively opt out.6Cornell Law School. Federal Rules of Civil Procedure Rule 23 – Class Actions
If your losses are significantly larger than what the settlement offers, opting out preserves your right to file your own suit. Someone whose identity was stolen, whose credit was destroyed, or who spent thousands on remediation may have claims worth far more than the class recovery. Opting out requires sending a written exclusion request to the administrator before a separate deadline, which is usually earlier than the claims deadline.
Objecting is different. When you object, you stay in the class but tell the court the terms are unfair. The judge considers objections at the final approval hearing, and if the settlement is approved anyway, you’re still bound by it. If you think the deal is genuinely inadequate, opting out is the stronger move.
When You’ll Get Paid, and How Much
After the filing deadline, the administrator reviews every claim for duplicates, documentation, and signs of inflation. Review can take months. Once claims are processed, a judge holds a final approval hearing to decide whether the settlement is fair.7Bloomberg Law. Litigation, Overview – Seeking Final Approval of Settlement: Class Actions Even after approval, a 30-day appeal window opens.8Cornell Law School. Federal Rules of Appellate Procedure Rule 4 – Appeal as of Right, When Taken Payments don’t go out until that window closes and any appeals are resolved, so months or more than a year can pass between filing and payment.
Most data breach settlements have a fixed pool of money. If 500,000 people file valid claims against a $50 million fund, each person’s share shrinks proportionally. This is pro-rata distribution, and it’s the biggest reason people receive less than they expected. A settlement advertising “up to $10,000 per claimant” may pay a fraction of that if claim rates are high. Your notice should say whether payments are pro-rata, but the actual per-person amount isn’t known until all claims are counted.
You typically pick a payment method on the form. Options vary but commonly include paper check, direct deposit, or digital transfer through services like PayPal or Venmo. Some settlements also enroll you in credit monitoring separate from any cash payout. If you move or change email after filing, update your contact information through the settlement website so a check doesn’t go unclaimed.
Taxes on Your Payout
Cash payouts from data breach settlements are generally taxable income. The IRS treats settlement payments as taxable unless a specific exclusion applies, and the key question is what the payment replaces.9Internal Revenue Service. Tax Implications of Settlements and Judgments Federal law excludes damages received for personal physical injuries or physical sickness from gross income.10Office of the Law Revision Counsel. 26 USC 104 – Compensation for Injuries or Sickness Data breaches almost never involve physical injury, so those exclusions rarely apply. Reimbursement for out-of-pocket losses and lost time is generally ordinary income.
Credit monitoring and identity theft protection services provided through a settlement are treated differently. The IRS has said it will not treat the value of free identity protection services offered to breach victims as taxable income. That treatment does not extend to cash received in place of monitoring.
For 2026, the reporting threshold for Form 1099-MISC increased to $2,000 per recipient per calendar year, up from $600. If your total payout is under $2,000, the administrator won’t send you a 1099, but the income is still technically taxable and should be reported. Beginning in 2027, the $2,000 threshold will be adjusted annually for inflation.11Internal Revenue Service. Publication 1099 (2026), General Instructions for Certain Information Returns
Spotting a Fake Settlement Notice
Data breach settlements attract scammers who send fake notices designed to steal exactly the information that was already compromised. A few habits protect you:
- Check the URL. Legitimate settlement websites use a specific domain tied to the case name, and government pages end in “.gov.” Look for “https://” in the address bar, which means the connection is encrypted.12Federal Trade Commission. Equifax Data Breach Settlement
- Verify the case through the court. Notices include a case number and court name. You can search federal court records through PACER or the court’s website to confirm the settlement exists.
- Never pay to file. Real claim forms are always free. If anyone asks for a processing fee, an “activation payment,” or a credit card number to submit a claim, it’s a scam.
- Watch for urgency pressure. Real deadlines are weeks or months out and printed in official court documents; scammers invent shorter ones to rush you.
- Confirm the sender. Check any email address against the administrator’s official contact information on the settlement website. Don’t click links in unsolicited emails. Type the address into your browser instead.
When in doubt, search the settlement name along with “FTC” or “class action” to find news coverage or official pages confirming it. The FTC maintains a refund page listing active settlements it oversees, which is a reliable way to verify a notice you received.