Capital One Data Breach Settlement: Payments Are Done, Free Protection Runs to 2028
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
The capital one data breach settlement is the $190 million deal over the 2019 hack that exposed about 98 million U.S. credit card applicants. It is over for cash: claims closed September 30, 2022, the last payments went out September 4, 2024, and uncashed checks are void. One benefit is still live — free identity protection and restoration help through February 13, 2028, even if you never filed a claim. If you saw “Capital One settlement” in the news recently, that is almost certainly the separate $425 million 360 Savings case.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What the Lawsuit Said Happened
Capital One says an outside individual accessed its data on March 22 and 23, 2019. An external security researcher reported the configuration weakness on July 17, 2019; the bank confirmed the intrusion on July 19, 2019 and announced it on July 29, 2019.
Per Capital One, the files held application data from people who applied for its credit cards from 2005 through early 2019: names, addresses, phone numbers, email addresses, dates of birth and self-reported income. It also said about 140,000 Social Security numbers and about 80,000 linked bank account numbers were taken, and no card numbers or log-in credentials. In January 2021 it found about 4,700 more Social Security numbers in the stolen files.
The class action, against Capital One and Amazon (the data sat in Amazon’s AWS cloud), alleged negligence, negligence per se, unjust enrichment, breach of contract and violations of state data-breach and consumer-protection laws. Capital One says the FBI caught the person responsible and the government believes the data was recovered.
Case Details
The federal suits were consolidated as In re: Capital One Consumer Data Security Breach Litigation, MDL No. 2915, No. 1:19-md-2915 in the U.S. District Court for the Eastern District of Virginia (Alexandria Division), before Judge Anthony J. Trenga. The parties signed the settlement on January 31, 2022. The court granted preliminary approval on February 7, 2022 and final approval on September 13, 2022, and awarded class counsel 28 percent of the fund. Official site: CapitalOneSettlement.com.
Separately, the Office of the Comptroller of the Currency fined Capital One $80 million on August 6, 2020 for failing to assess risk properly before moving IT operations to the public cloud. That penalty went to the U.S. Treasury, not to customers.
Status: Settled, Paid Out, Protection Still Running
Still available until February 13, 2028: Identity Defense Services (dark-web and identity monitoring, security freezes, $1 million no-deductible identity-theft insurance) and Restoration Services (fraud specialists who help with fraud alerts and credit-report disputes). Both are free, and class members who never filed a claim can still use them. To enroll in Identity Defense, call Pango at 833-317-4821 for an enrollment code. For Restoration Services, call 505-896-7416.
Who Was in the Class
The class was “the approximately 98 million U.S. residents identified by Capital One whose information was compromised” in the breach announced July 29, 2019. Capital One put the total at about 100 million people in the United States and about 6 million in Canada. Canadians were not in this U.S. class.
Membership was set by Capital One’s class list. You could not sign up: you either received notice or you did not. The opt-out and objection deadline was July 7, 2022. If you did nothing, you are bound by the settlement and cannot sue separately over this breach, but you can still use the protection services until February 13, 2028.
Different case, same name: the 2026 dispute over Capital One Arena ticket fees has nothing to do with this breach. See our report on the Aramark venue-fee settlement.
What the Settlement Paid
• Out-of-pocket losses: up to $25,000 for documented, unreimbursed costs, such as identity theft, falsified tax returns, or credit freezes and credit reports bought on or after March 22, 2019.
• Lost time: $25 per hour (or your documented wage if you took time off work), for up to 15 hours alongside a loss claim or up to 5 hours without one.
• Identity protection and restoration for every class member.
According to the final approval order, “hundreds of thousands” of class members filed claims, and class counsel expected valid out-of-pocket claims to be paid in full or nearly in full. The administrator has not published an average payment, so we do not repeat the per-person figures that circulate online. Nothing more is payable now. To see what a documented-loss claim is worth in a breach settlement that is still open, use our data breach settlement calculator.
Capital One Data Breach Timeline
- 1
March 22–23, 2019 — The Data Is Taken
Per Capital One, an outside individual accesses credit card application data stored in the cloud. Capital One confirms it July 19 and announces it July 29, 2019.
- 2
August 6, 2020 — $80 Million OCC Penalty
The bank regulator fines Capital One over its cloud risk management. The money goes to the U.S. Treasury, not to customers.
- 3
February 7, 2022 — Preliminary Approval
Judge Trenga preliminarily approves the $190 million settlement in MDL No. 2915. The opt-out and objection deadline is July 7, 2022.
- 4
September 2022 — Final Approval, Claims Close
Final approval comes on September 13, 2022. The deadline for loss and lost-time claims was September 30, 2022.
- 5
September 2023 to September 2024 — Payments
First payments go out from September 28, 2023. A second payment follows on September 4, 2024 for claimants who accepted the first. Payments are now complete.
- 6
Through February 13, 2028 — Protection Services
Free Identity Defense and Restoration Services through Pango remain open to all class members, including those who never filed a claim.
Three Things to Watch For
A famous settlement that has finished paying still attracts people who say it has not:
“Your Capital One breach payment is waiting”
Payments are complete and uncashed checks are void. Any message offering to release or reissue a breach payment, especially for a fee or your bank login, is not from the administrator.
Calls mixing up the two Capital One settlements
The 360 Savings case pays automatically if and when its appeal is resolved, and the breach case has finished paying. A caller who asks for your Social Security number to “file” for either one is fishing for data.
Look-alike enrollment links
The free protection is enrolled through Pango using a code from 833-317-4821, as listed on CapitalOneSettlement.com. Don’t pay for “settlement monitoring”: the real service is free through February 13, 2028.
Capital One Data Breach Settlement — Questions People Actually Ask
What happened to the Capital One class action settlement?
The $190 million capital one data breach settlement got final approval on September 13, 2022 and has finished paying. Payments went out from September 28, 2023, with a second round on September 4, 2024. Only the free identity protection and restoration services remain, through February 13, 2028.
What happened with the Capital One credit card breach?
Per Capital One, an outside individual took credit card application data on March 22 and 23, 2019. It affected about 100 million people in the U.S. and about 6 million in Canada, including about 140,000 Social Security numbers and about 80,000 linked bank account numbers. No card numbers or log-ins were taken, according to the bank.
How much do you get from a data breach settlement?
In this one, documented out-of-pocket losses were reimbursable up to $25,000. Lost time paid $25 per hour, for up to 5 hours without a loss claim or up to 15 hours with one. Every class member also got free protection services. No official average payment has been published. Other breach settlements use different terms.
Can I still file a claim?
No. The claim deadline was September 30, 2022, and the administrator no longer accepts documentation or reissue requests. You can still enroll in free Identity Defense by calling Pango at 833-317-4821, or use Restoration Services at 505-896-7416, until February 13, 2028.
I never got my check. What now?
According to the official site, all payment activity has ended, no reissue requests are accepted, and uncashed checks are void. There is no longer any way to get a breach payment reissued.
Is the $425 million Capital One settlement the same thing?
No. That is In re: Capital One 360 Savings Account Interest Rate Litigation, No. 1:24-md-03111, also in the Eastern District of Virginia, over savings interest rates. Judge David J. Novak gave final approval on April 20, 2026. A class member appealed on June 17, 2026 (Fourth Circuit No. 26-1807), so as of October 2026 those payments are on hold.
Is there a lawsuit against Capital One credit card?
Yes, but not over the breach, which is settled. Card-related suits, including a pending rewards case, are tracked on our Capital One credit card lawsuit page.
What is still worth doing?
If your Social Security number or bank account number was in the breach, freezing your credit at all three bureaus is free and reversible. Enrolling in the settlement’s free Identity Defense Services before February 13, 2028 adds monitoring and $1 million in identity-theft insurance at no cost.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Capital One Credit Card Lawsuit
The rewards case and other card suits — separate from the 2019 breach
Equifax Data Breach Settlement
The other giant credit-data breach settlement, for comparison
Data Breach Settlement Calculator
Estimate what a breach claim with documented losses is worth
Open Class Action Settlements
Settlements that are still taking claims right now