Data Breach Class Action Lawsuits

A massive AT&T data breach discovered in 2024 exposed the personal information of approximately 73 million current and former customers — including Social Security numbers and account passcodes — triggering a nationwide wave of class action lawsuits over the company's alleged failure to protect consumer data.

Following a massive breach of Ticketmaster's database by hacking group ShinyHunters, class action lawsuits allege Live Nation failed to adequately secure the personal and financial data of over 560 million customers worldwide.

Consolidated class action arising from Marriott's massive Starwood guest reservation database breach exposing up to 500 million guests' personal and passport data, followed by a second breach in 2020 affecting 5.2 million additional guests.

Plaintiffs allege Oracle secretly harvested personal data from billions of people worldwide—including browsing history, purchases, and location data—through its vast advertising and data brokerage network, without meaningful consent.

Nearly 17 million customers of mortgage lender loanDepot filed suit after a January 2024 ransomware attack exposed sensitive personal and financial data, including Social Security numbers, dates of birth, and bank account information.

CDK Global, a software platform used by approximately 15,000 auto dealerships across North America, was crippled by a ransomware attack in June 2024 that shut down dealership operations for weeks. Class actions were filed on behalf of dealerships and their customers alleging CDK failed to maintain adequate cybersecurity, causing massive business disruption and exposing sensitive consumer financial data.

23andMe faces a sweeping class action after hackers accessed the genetic and ancestry data of nearly 7 million customers, exposing deeply personal biological information through a credential-stuffing attack. The lawsuit alleges the company failed to implement adequate security protections for uniquely sensitive data that cannot be changed like a password or credit card number.

Tens of millions of current and former AT&T customers sued the telecom giant after it confirmed a massive data breach exposing Social Security numbers, account passcodes, and other sensitive personal information on the dark web. A separate July 2024 breach exposed call and text records for nearly all AT&T wireless customers.

Shareholders and customers of SolarWinds sued the IT management software company after a sophisticated nation-state cyberattack — attributed to Russian intelligence — compromised its Orion platform and infiltrated the networks of up to 18,000 government agencies and Fortune 500 companies beginning in 2020.

Auto dealerships and consumers across the U.S. are suing CDK Global after a ransomware attack in June 2024 shut down its software platform used by approximately 15,000 car dealerships nationwide, halting vehicle sales and exposing sensitive customer data for nearly three weeks.

Patients across the U.S. filed class action lawsuits alleging that hospitals and healthcare providers secretly embedded Meta's tracking pixel on their websites and patient portals, transmitting sensitive medical information to Facebook without patient consent, in violation of HIPAA and state privacy laws.

Developers and organizations allege that Microsoft and GitHub failed to adequately secure the npm software registry and GitHub Actions pipeline, exposing millions of open-source software supply chains to malicious code injection and credential theft.

Patients and healthcare providers allege that Meta's tracking pixel was secretly embedded on hospital and health system websites, transmitting sensitive medical information — including appointment details and health conditions — to Facebook without patients' knowledge or consent.

A February 2024 ransomware attack on Change Healthcare — a UnitedHealth Group subsidiary — exposed the personal health and financial data of an estimated 190 million Americans, making it the largest healthcare data breach in U.S. history.

Hundreds of millions of consumers whose personal data was exposed in the 2024 Snowflake cloud storage breach — affecting AT&T, Ticketmaster, Advance Auto Parts, and over 160 other major companies — have sued for inadequate data security and failure to protect sensitive customer information.

TikTok agreed to a $92 million settlement over allegations it secretly harvested biometric data, location information, and personal data from millions of users — including minors — without proper consent.

Patients, healthcare providers, and pharmacies nationwide sue UnitedHealth Group and its subsidiary Change Healthcare after a February 2024 ransomware attack — the largest healthcare data breach in U.S. history — exposed the sensitive medical and financial data of an estimated 190 million Americans.

Class action alleging that popular apps and online games knowingly collected personal data from children under 13 without parental consent.

Patients of a large hospital network sue after a ransomware attack exposed millions of sensitive protected health information (PHI) records.

TikTok agreed to pay $92 million to settle claims that it secretly harvested biometric data—including faceprints and voiceprints—from millions of users, including minors, without consent in violation of Illinois BIPA and federal privacy laws.

TikTok users sued ByteDance alleging the app secretly collected facial geometry and other biometric data without consent, violating Illinois' Biometric Information Privacy Act (BIPA) and similar state laws. The case settled for $92 million in 2021.

A 2019 cyberattack on Capital One exposed the personal and financial data of approximately 98 million U.S. consumers and small businesses, leading to a $190 million class action settlement.

A $250K settlement resolves a class action lawsuit over an April 2025 data breach at Fitzgerald Wealth Management, providing cash compensation and credit monitoring services to affected individuals.

Approximately 147 million Americans sued Equifax after a catastrophic 2017 data breach exposed their Social Security numbers, birthdates, addresses, driver's license numbers, and credit card information due to the company's failure to patch a known security vulnerability.

A massive 2021 cyberattack exposed the personal data of approximately 76.6 million current, former, and prospective T-Mobile customers, leading to a $350 million class action settlement.

Facebook users filed a class action lawsuit alleging the platform improperly shared their personal data with third parties, including political consulting firm Cambridge Analytica, leading to a historic $725 million settlement — the largest ever in a U.S. data privacy class action.