Yahoo Data Breach Class Action Claim Form: Payments, Scams, and Taxes

The Yahoo data breach class action claim form is no longer being accepted. The filing deadline for the $117.5 million settlement passed on July 20, 2020, and the settlement administrator, Kroll Settlement Administration LLC, is not taking new submissions.¹ Distributions to people who filed on time began on June 9, 2023, and a deficiency review is still working through the remaining claims. If you filed and haven’t received a check, your claim is likely still in that queue.

Why Payments Started When They Did

The Ninth Circuit Court of Appeals affirmed the final approval order on September 27, 2022. That ruling triggered the settlement’s effective date and cleared the way for distributions.¹ Checks began going out on June 9, 2023, with the administrator asking recipients to allow six to eight weeks for delivery. Status updates are posted at yahoodatabreachsettlement.com.²

If You Filed and Haven’t Been Paid

A filed claim can still be unpaid for a straightforward reason: it’s in deficiency review. The administrator checks each submission for duplicate filings, confirms that the email addresses match compromised accounts, and verifies documentation on out-of-pocket claims. When something is missing or unclear, a deficiency notice goes out explaining what additional evidence is needed.

If you receive one of those notices, respond by the deadline it specifies. Ignoring it can result in denial even though you filed on time. Claims that include out-of-pocket expense reimbursements tend to sit in review longest because each receipt and statement has to be verified.

If you filed online, the confirmation code you received at submission is what the administrator uses to look up your claim. Contact Kroll through the official portal if you need a status update.²

Who Was Eligible

The class covered U.S. and Israeli residents who either held a Yahoo account between January 1, 2012, and December 31, 2016, or received an official breach notification in 2016 or 2017. “Yahoo account” was broad: Flickr, Tumblr, Yahoo Fantasy Sports, Yahoo Finance, and other Yahoo-operated sites all counted.³

What Your Payment Should Be

Knowing what benefit you selected helps you gauge what check to expect.

Credit Monitoring or Cash

Basic account holders picked between two years of AllClear ID credit monitoring across Experian, Equifax, and TransUnion, or an alternative cash payment. The cash option was pegged at $100 but could pay as little as under $100 or as much as $358.80 depending on how many people participated. Choosing cash required naming an existing credit monitoring provider you planned to keep for at least a year.¹

The credit monitoring benefit also included identity theft monitoring with phone alerts, coverage for minor children up to age 18, $1 million in identity theft insurance, and restoration assistance. If money remains after all claims are paid, the monitoring period can extend beyond two years.³

Out-of-Pocket Reimbursement

Claimants who documented breach-related expenses could seek up to $25,000 per claim. Eligible costs included credit monitoring you bought on your own after the breach, unreimbursed identity fraud losses, professional fees for handling identity theft or fraudulent tax returns, credit freeze fees, and miscellaneous costs like postage, notary fees, mileage, and copying.³

Time Spent

Documented identity fraud tied to the breach let you claim up to 15 hours at $25 per hour, or your documented hourly wage if higher. Without documentation of actual fraud, the cap was five hours at the same rate.³

Paid Yahoo and Small Business Users

Subscribers to Yahoo Ad-Free Mail and other premium services were eligible for a 25% refund on subscription costs. Small business users who paid for Aabaco services could claim reimbursement for a portion of those costs. Both categories could stack with either the credit monitoring or cash option, and with an out-of-pocket claim.¹

Watch for Scams

A breach touching three billion accounts draws impostors. The only legitimate site for this settlement is yahoodatabreachsettlement.com.³ Any message asking you to pay a fee, share a Social Security number, or wire money to release your check is fraudulent. The FTC notes that legitimate settlement administrators never demand payment before sending your check.⁴ If a message looks suspicious, go to the official portal directly instead of clicking any link.

Do You Owe Tax on the Payment?

Data breach settlement payments generally count as taxable income because they compensate for economic losses rather than physical injury. The federal reporting threshold for Form 1099-MISC rose from $600 to $2,000 for payments made on or after January 1, 2026, under the One, Big, Beautiful Bill Act. The alternative cash payment tops out at $358.80, so most people who received only that payment will not get a 1099 at the new threshold. Larger out-of-pocket reimbursements can cross it. Regardless of whether a 1099 arrives, the IRS expects all taxable income to be reported. Keep your payment records, and check with a tax professional if you received a substantial reimbursement.

1
Yahoo! Inc. Customer Data Security Breach Litigation Settlement. Yahoo! Inc. Customer Data Security Breach Litigation Settlement
2
Yahoo! Inc. Customer Data Security Breach Litigation Settlement. Yahoo! Inc. Customer Data Security Breach Litigation Settlement – Contact
3
Yahoo! Inc. Customer Data Security Breach Litigation Settlement. Yahoo! Inc. Customer Data Security Breach Litigation Settlement – FAQs
4
Federal Trade Commission. FTC Refund Programs