Data Breach Compensation: How Much Can You Claim in 2026?

One of the first questions every notification-letter recipient asks is simple: what is this worth? This page breaks down how data breach compensation actually works — the claim tiers, the statutory damages, and the factors that move an individual payout from the low end to the high end.

The Four Tiers of Data Breach Compensation

Most settlements and claims follow a tiered structure. Where you fall depends on your documentation, not your luck.

• Tier 1 — Baseline fund payment. A flat payment (historically roughly $25 to $100) for anyone in the affected class who files a claim. No documentation of loss required beyond the letter.
• Tier 2 — Time compensation. Payment for hours spent dealing with the breach — freezing credit, disputing charges, replacing documents — often calculated at an hourly rate with a cap, sometimes with attestation only.
• Tier 3 — Documented out-of-pocket losses. Reimbursement for actual fraud losses, credit repair, replacement documents, travel, or professional fees. Requires receipts but pays the most in ordinary cases.
• Tier 4 — Extraordinary losses. Documented identity-theft losses with a traceable link to the breach. These are the multi-thousand-dollar claims, and they are why preserving records matters.

Statutory Damages: The Amount Set by Law

In several states, the law itself sets a dollar amount per person per violation, independent of what you actually lost:

• California: $100 to $750 per consumer per incident under the CCPA for certain breaches of unencrypted personal information.
• Illinois: $1,000 to $5,000 per violation under BIPA when biometric data (fingerprints, face scans) is mishandled — biometric cases have produced some of the largest per-person awards.
• Other states: many consumer-protection statutes add treble damages or fee-shifting, which raises settlement pressure on the company.

This is why two people with the same breach can have very different claims: the exposed data category and the state of residence change the legal arithmetic.

What Determines Your Payout

• What was exposed. Social Security numbers and financial data command the highest tiers. A name and email alone sit at the baseline.
• Your state. Statutory-damages states materially raise claim value.
• Your documentation. A folder of receipts converts a Tier 1 claim into Tier 3.
• How many people file. In claims-made settlements, the fund is divided among claimants — fewer claims means larger shares. This is why unclaimed settlements leave money on the table.
• The settlement structure. Common-fund settlements divide a fixed pool; claims-made funds pay only actual claims.

Realistic Expectations

For most notification-letter recipients without documented fraud, a valid claim historically pays somewhere between the baseline fund payment and a few hundred dollars including time compensation. With documented losses or biometric/statutory exposure, four-figure outcomes occur. Anyone promising a specific number before reviewing your letter and state is guessing.

What compensation reliably includes in nearly every major settlement: multi-year credit monitoring beyond what the company voluntarily offered, and the enforcement value of forcing security changes at the company.

How to Position Your Claim for the Higher Tiers

1. Save the notification letter and the envelope date.
2. Freeze credit at all three bureaus and keep the confirmation numbers.
3. Log every hour spent and every expense incurred because of the breach.
4. File before the claim deadline — late claims pay nothing.
5. Get the claim reviewed professionally; tier eligibility is frequently misjudged by self-filers.

The Law Office of David S. Harris reviews claims free of charge and works on contingency — no fee unless the case recovers. Request your free review →

Frequently Asked Questions

Do I pay taxes on data breach compensation?

Compensation for out-of-pocket losses and identity-theft harm is generally not treated as income, while portions attributable to emotional distress or punitive components can be. Settlement tax notices (1099s) depend on the settlement's structure. Ask a tax professional about your specific award.

I only got a name-and-email letter. Is it worth filing?

Baseline tier claims exist precisely for this situation. The payment is modest, but the credit monitoring and the five minutes to file make it worthwhile — and it preserves your rights if fraud emerges later within the claims period.

What if the company already gave me free credit monitoring?

Accept it, and file anyway. The company's offer does not waive your claim, and settlements frequently provide additional years and additional payment tiers beyond the voluntary offer.

Related: How to File a Data Breach Lawsuit · What Damages Can You Recover? · Free Case Review