Data Breach Class Action Lawsuits

Educational Computer Systems Inc. has agreed to a $6.5 million settlement to resolve claims related to a data breach that compromised consumer information.

Sportsman’s Guide agreed to pay a settlement to resolve allegations that it shared firearm purchase information without the proper consent of Pennsylvania residents. The settlement benefits individuals who ordered or reserved a firearm online from the retailer between January 11, 2021, and July 7, 2026.

This settlement addresses claims that Carter Credit Union failed to safeguard members' personal data following a data breach that occurred around June 25, 2025.

Americold has agreed to pay $5.25 million to settle claims related to two data breaches that occurred in 2020 and 2023. The settlement benefits individuals whose personal information was compromised during these incidents.

Lawsuits have been filed concerning a cybersecurity incident at Veradigm, which involved the unauthorized downloading of patient personal data from a third-party vendor. The breach exposed sensitive information, including some Social Security numbers, through a limited software connection.

A class action lawsuit alleges that Citigroup illegally monitored the online activities of its website visitors using tracking pixels. The complaint claims this interception occurred without the users' knowledge or consent for commercial gain.

Wellstar Health System agreed to a $4.25 million settlement to resolve claims regarding the use of tracking technologies on its website that allegedly disclosed patient information to third parties.

Wayne Memorial Hospital agreed to a settlement to resolve claims related to a 2024 data breach that exposed sensitive patient information. The settlement offers class members potential compensation for documented losses and free credit monitoring services. To participate, affected individuals must submit a valid claim form by the specified deadline.

A class action lawsuit alleges that OneMain Financial failed to adequately protect customer personal information following a data breach. The suit claims the company's failure to secure data exposed sensitive details like Social Security numbers. The lawsuit seeks damages and improved security measures for affected customers.

A class action lawsuit was filed alleging that DentaQuest failed to adequately protect the private information of millions of patients following a data breach. The suit claims the company's failure to maintain proper cybersecurity led to the exposure of sensitive personal health and identifying data. The lawsuit is currently active, and affected individuals are advised to seek counsel regarding their potential claims.

A class action lawsuit has been filed against Carhartt Inc. following a data breach that exposed the personal information of many individuals. The lawsuit alleges that the company failed to adequately protect customer data, leading to the compromise of sensitive personal identifying information.

A class action lawsuit alleges that Lennar Corp. and Lennar Mortgage LLC failed to adequately protect the sensitive personal information of its customers and employees during a data breach. The plaintiff claims this failure resulted in the exposure of data, including Social Security numbers, due to the company's lax security practices.

This settlement addresses a data breach that occurred at Community Dental Care in December 2024, compromising sensitive patient information. Class members can receive cash payments and credit monitoring benefits for the breach.

A class action lawsuit was filed alleging that Five Below secretly intercepted and transmitted users' personal shopping activity and data to various third parties. The suit claims that the company's mobile apps tracked user behavior without proper notice or consent.

Evernorth Health Inc. and MDLive Inc. agreed to pay up to $3.5 million to resolve claims that they improperly shared sensitive user data with Google and Meta.

Two former employees of BuzzFeed have initiated class action lawsuits alleging that the company failed to adequately protect sensitive personal information belonging to its employees and others. The lawsuits claim that BuzzFeed's negligence led to a data breach, exposing various types of private data.

Finastra Technology Inc. agreed to pay $3.12 million to resolve a class action lawsuit concerning a data breach that occurred in October 2024. The settlement benefits individuals who received notification that their personal information may have been compromised during that incident. Class members can claim reimbursement for documented losses or opt for a pro rata cash payment, alongside free credit monitoring services.

Managed Care of North America agreed to a settlement to resolve claims related to a 2023 data breach that exposed sensitive personal and medical information.

A settlement was reached regarding a data breach that occurred at Tift Regional Health System in 2022, affecting patient information. The settlement provides benefits to individuals whose private data may have been compromised during the incident. Class members can receive cash payments and credit monitoring services through the settlement process.

CVS agreed to a $20.5 million settlement to resolve allegations that it shared consumer data with third parties without obtaining the consumers' consent. The settlement benefits anyone who accessed CVS's digital properties before July 27, 2026. The class action lawsuit alleged that the company violated consumer privacy rights by sharing personal information with third parties, such as a digital advertising company.

American Income Life Insurance Company and Globe Life Inc. reached a settlement to resolve claims related to a data breach that occurred in 2024. The settlement benefits individuals who received notification that their personal data may have been compromised. Class members can seek reimbursement for documented losses and compensation for lost time.

A class action lawsuit was filed alleging that Hims & Hers Health improperly collected and shared consumers' sensitive health information using website tracking technologies without consent. The suit claims violations of state privacy laws and seeks damages for the unauthorized use of personal health data.

Summit Medical Group agreed to a settlement to resolve claims related to a 2024 data breach that exposed private patient information. The settlement provides benefits such as free medical data monitoring and compensation for documented losses.

American Vision Partners agreed to a $1.75 million settlement to resolve claims related to a 2023 data breach that exposed sensitive patient information. The settlement benefits individuals whose personal data, including Social Security numbers, were compromised in the November 2023 incident. Class members can receive either a cash payment or reimbursement for documented out-of-pocket losses.

Two separate class action lawsuits have been filed against an Applebee's franchisee following a data breach that occurred in April 2026. The complaints allege that the franchisee failed to adequately protect the private information of its employees and customers. Plaintiffs claim the company's negligence and failure to secure sensitive data led to significant harm for those affected.

This settlement addresses claims related to a 2024 data breach at Furniture Mart USA that exposed sensitive consumer personal information. Affected individuals can receive compensation for documented losses and free credit monitoring services. To participate, class members must submit a valid claim form by the specified deadline.

The University of Hawaii agreed to a $3.5 million settlement to resolve claims related to a 2025 data breach that exposed sensitive research participant information. The settlement benefits individuals who were notified that their personal data was potentially compromised during the breach.

ConnectOnCall and Phreesia agreed to a $4.95 million settlement to resolve claims related to a 2024 data breach that exposed sensitive consumer information.

FinWise Bank, FinWise Bancorp, and American First Finance agreed to a $2.8 million settlement to resolve claims related to a 2024 data breach. The settlement benefits individuals whose personal information was compromised, including names, Social Security numbers, and account numbers.

Highlands Oncology Group has reached a settlement to resolve claims stemming from a data breach that compromised patient information. The lawsuit alleged that the cancer treatment center failed to adequately protect sensitive patient data. Affected individuals can receive compensation for documented losses or a set cash payment.

American Well Corp., which operates the LiveHealth Online service, agreed to a settlement to resolve allegations that it violated privacy laws by sharing medical information with third parties. The lawsuit concerns individuals who used the appointment booking tool on the LiveHealth Online platform between October 2024 and August 2025.

Modernizing Medicine Inc. agreed to a $2.99 million settlement to resolve claims related to a data breach that occurred in 2025. The settlement benefits individuals who received a notice about their compromised personal information from the company.

A class action lawsuit alleges that TikTok unlawfully shared private student data from its AI homework-help service, Gauth, with Google. The suit claims this data was transmitted without the users' knowledge or consent, potentially exposing sensitive academic information.

Multiple class action lawsuits have been filed against Aesto LLC concerning a significant data breach that exposed sensitive patient information. The lawsuits allege that Aesto failed in its duty to protect this private health data, leading to claims of negligence and privacy violations. Affected individuals can seek representation through the named lawsuits, which are currently active in federal court.

ABC Legal Services agreed to a $2.5 million settlement to resolve claims related to a data breach that occurred in 2024. The settlement provides benefits to individuals whose personal information was potentially compromised.

One of the largest data breaches in history, in which a background-check data broker exposed the Social Security numbers, addresses, and personal data of nearly 3 billion people — including many who never directly interacted with the company.

A massive AT&T data breach discovered in 2024 exposed the personal information of approximately 73 million current and former customers — including Social Security numbers and account passcodes — triggering a nationwide wave of class action lawsuits over the company's alleged failure to protect consumer data.

Following a massive breach of Ticketmaster's database by hacking group ShinyHunters, class action lawsuits allege Live Nation failed to adequately secure the personal and financial data of over 560 million customers worldwide.

Consolidated class action arising from Marriott's massive Starwood guest reservation database breach exposing up to 500 million guests' personal and passport data, followed by a second breach in 2020 affecting 5.2 million additional guests.

Plaintiffs allege Oracle secretly harvested personal data from billions of people worldwide—including browsing history, purchases, and location data—through its vast advertising and data brokerage network, without meaningful consent.

Nearly 17 million customers of mortgage lender loanDepot filed suit after a January 2024 ransomware attack exposed sensitive personal and financial data, including Social Security numbers, dates of birth, and bank account information.

CDK Global, a software platform used by approximately 15,000 auto dealerships across North America, was crippled by a ransomware attack in June 2024 that shut down dealership operations for weeks. Class actions were filed on behalf of dealerships and their customers alleging CDK failed to maintain adequate cybersecurity, causing massive business disruption and exposing sensitive consumer financial data.

23andMe faces a sweeping class action after hackers accessed the genetic and ancestry data of nearly 7 million customers, exposing deeply personal biological information through a credential-stuffing attack. The lawsuit alleges the company failed to implement adequate security protections for uniquely sensitive data that cannot be changed like a password or credit card number.

Tens of millions of current and former AT&T customers sued the telecom giant after it confirmed a massive data breach exposing Social Security numbers, account passcodes, and other sensitive personal information on the dark web. A separate July 2024 breach exposed call and text records for nearly all AT&T wireless customers.

Shareholders and customers of SolarWinds sued the IT management software company after a sophisticated nation-state cyberattack — attributed to Russian intelligence — compromised its Orion platform and infiltrated the networks of up to 18,000 government agencies and Fortune 500 companies beginning in 2020.

Auto dealerships and consumers across the U.S. are suing CDK Global after a ransomware attack in June 2024 shut down its software platform used by approximately 15,000 car dealerships nationwide, halting vehicle sales and exposing sensitive customer data for nearly three weeks.

Patients across the U.S. filed class action lawsuits alleging that hospitals and healthcare providers secretly embedded Meta's tracking pixel on their websites and patient portals, transmitting sensitive medical information to Facebook without patient consent, in violation of HIPAA and state privacy laws.

Developers and organizations allege that Microsoft and GitHub failed to adequately secure the npm software registry and GitHub Actions pipeline, exposing millions of open-source software supply chains to malicious code injection and credential theft.

A February 2024 ransomware attack on Change Healthcare — a UnitedHealth Group subsidiary — exposed the personal health and financial data of an estimated 190 million Americans, making it the largest healthcare data breach in U.S. history.

Patients and healthcare providers allege that Meta's tracking pixel was secretly embedded on hospital and health system websites, transmitting sensitive medical information — including appointment details and health conditions — to Facebook without patients' knowledge or consent.

Hundreds of millions of consumers whose personal data was exposed in the 2024 Snowflake cloud storage breach — affecting AT&T, Ticketmaster, Advance Auto Parts, and over 160 other major companies — have sued for inadequate data security and failure to protect sensitive customer information.

Patients, healthcare providers, and pharmacies nationwide sue UnitedHealth Group and its subsidiary Change Healthcare after a February 2024 ransomware attack — the largest healthcare data breach in U.S. history — exposed the sensitive medical and financial data of an estimated 190 million Americans.

Class action alleging that popular apps and online games knowingly collected personal data from children under 13 without parental consent.

Patients of a large hospital network sue after a ransomware attack exposed millions of sensitive protected health information (PHI) records.

The University of Pennsylvania Health System agreed to a settlement to resolve claims regarding the use of tracking pixels on its website that allegedly shared patient data with third parties. This settlement benefits individuals who accessed the myPennMedicine patient portal within a specific timeframe and had a Pennsylvania address on file. The settlement also mandates changes to the health system's website governance policies.

TikTok agreed to a $92 million settlement over allegations it secretly harvested biometric data, location information, and personal data from millions of users — including minors — without proper consent.

A 2019 cyberattack on Capital One exposed the personal and financial data of approximately 98 million U.S. consumers and small businesses, leading to a $190 million class action settlement.

A $250K settlement resolves a class action lawsuit over an April 2025 data breach at Fitzgerald Wealth Management, providing cash compensation and credit monitoring services to affected individuals.

Approximately 147 million Americans sued Equifax after a catastrophic 2017 data breach exposed their Social Security numbers, birthdates, addresses, driver's license numbers, and credit card information due to the company's failure to patch a known security vulnerability.

A massive 2021 cyberattack exposed the personal data of approximately 76.6 million current, former, and prospective T-Mobile customers, leading to a $350 million class action settlement.

Facebook users filed a class action lawsuit alleging the platform improperly shared their personal data with third parties, including political consulting firm Cambridge Analytica, leading to a historic $725 million settlement — the largest ever in a U.S. data privacy class action.