CDCR Data Breach Settlement: $1.8 Million, Payments Already Sent
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
This is the CDCR lawsuit over the data breach the California Department of Corrections and Rehabilitation discovered in January 2022 — records of people in state prisons and on parole. It settled for $1.8 million. The claim deadline was February 14, 2025, final approval came on June 13, 2025, and as of October 2026 the official settlement site says payments have been completed. There is nothing left to file.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What the Lawsuit Was About
In January 2022 CDCR discovered that an unauthorized user had accessed data on one of its platforms. Per reporting by HIPAA Journal, the systems held COVID-19 testing data from June 2020 to January 2022, mental-health records from the Mental Health Services Delivery System dating back to 2008, and possibly data from the Trust, Restitution, Accounting, and Canteen System (TRACS). The breach was reported to federal health regulators as involving up to 236,000 people.
The lawsuit alleged that CDCR did not have adequate safeguards to keep that data out of unauthorized hands. CDCR denied wrongdoing and said there was no indication any data was copied or downloaded. The settlement is not an admission of liability.
Case Details
The case is Thomas, et al. v. California Department of Corrections and Rehabilitation, Case No. 34-2022-00328693-CU-PO-GDS, in the Superior Court of California, County of Sacramento, Department 23, before Judge Jill H. Talley. It is a state-court case, not a federal one. The court granted preliminary approval on September 11, 2024 and signed the order granting final approval at the hearing on June 13, 2025. That order states that all rights to appeal were waived. The settlement administrator is CPT Group, Inc. — official site: cdcrdataclassactionsettlement.com.
Status: Settled, Claims Closed, Payments Sent
The settlement became effective on August 17, 2025, and an archived version of the site from September 2025 said payments were expected by the end of that month. The court set a compliance status conference for June 12, 2026, where the administrator was to account for distributions and uncashed checks; that report was not publicly posted when this page was updated.
Who Was in the Settlement Class
The court defined the class as all individuals in California whose protected health information or personally identifiable information was stored by CDCR and/or exposed in the breach discovered in or around January 2022. In practice that means people incarcerated in or paroled from state prisons whose records sat on the affected platform.
The final approval order counts 327,188 people who will receive a share: 283,405 who were on CDCR's list with a valid mailing address and got a postcard notice (they were included automatically), plus 43,783 who filed a valid claim form. Sixty-seven people opted out. If you did not get a postcard and did not file by February 14, 2025, you are bound by the settlement but receive no payment.
How Much Each Person Got
The administrator has not published the per-person amount. If administration costs reached the cap, the net fund was $579,317.33, which divided by 327,188 people works out to roughly $1.77 per person. If costs came in lower, shares were somewhat higher — but in any case a few dollars, not hundreds. For people in custody, CDCR must deduct outstanding restitution under Penal Code Section 2085.8, and other liens may also be deducted, so some shares were reduced or absorbed entirely.
CDCR Data Breach Settlement Timeline
- 1
January 2022 — Breach Discovered
CDCR discovers that an unauthorized user accessed data on one of its platforms, including health and mental-health records of incarcerated people.
- 2
September 11, 2024 — Preliminary Approval
Judge Jill H. Talley of Sacramento Superior Court preliminarily approves a $1.8 million class settlement in Thomas v. CDCR.
- 3
December 16, 2024 — Notices Mailed
Postcard notices go out by first-class mail. CPT Group also posts notices in prisons and runs a media campaign.
- 4
February 14, 2025 — Deadlines Pass
Last day to file a claim, opt out or object. The claim portal closes at 11:59 p.m.
- 5
June 13, 2025 — Final Approval
The court grants final approval, awards fees and costs, and enters judgment. Appeal rights are waived.
- 6
August 17, 2025 — Settlement Effective
The settlement becomes effective on August 17, 2025; an archived September 2025 version of the site expected payments by the end of that month. As of October 2026 the official site lists payments as completed.
Three Things to Watch For
A closed settlement involving people in custody and their families draws a specific kind of fraud:
“Late claim” or “reopen your CDCR claim” offers
The claim deadline was February 14, 2025 and the portal is closed. Anyone offering to file a CDCR claim now, for a fee or for your Social Security number, cannot do what they promise.
Messages to family members asking for money
Payments for incarcerated class members went directly to the correctional institution. No legitimate administrator asks relatives to pay a fee, send a money transfer or buy gift cards to “release” someone's settlement share.
“Recover your expired check” services
Under the settlement agreement, uncashed checks expire after 180 days and unclaimed money reverts to the State of California — not to a recovery service. The only party that could reissue a check is CPT Group, at 1-888-735-6130.
CDCR Data Breach Settlement — Questions People Actually Ask
CDCR data class action settlement how much will I get?
Each participating class member got an equal share of what was left of the $1.8 million after fees and costs. No official per-person figure has been published; if administration costs reached the court-approved cap, the share was roughly $1.77. If you were in custody, restitution or liens may have reduced it.
What was the CDCR data class action settlement payout date?
The settlement became effective on August 17, 2025, and payments were expected by the end of September 2025. As of October 2026 the official site says settlement payments have been completed.
Can I still file a claim in the CDCR data class action settlement?
No. The deadline was February 14, 2025, and the claim portal is closed. People who received a postcard notice did not need to file — they were paid automatically.
I never received or never cashed my payment. What now?
Contact the administrator, CPT Group, at 1-888-735-6130 or PO Box 19504, Irvine, CA 92623. Under the agreement, checks expire 180 days after issuance; a class member could ask for a reissue within 30 days of expiry, and a reissued check expires after 60 days. Uncashed money reverts to the State of California, so a late request may not be honored.
I was incarcerated. Where did my money go?
Payments for incarcerated class members were sent directly to the correctional institution. Under the settlement agreement, CDCR deducts outstanding restitution owed under Penal Code Section 2085.8, and other liens may be deducted. Funds deposited to inmate trust accounts can be held for up to 30 days.
Is there a new CDCR class action lawsuit 2025 or 2026 over this breach?
We found no new data-breach class action against CDCR filed in 2025 or 2026. The CDCR lawsuit over the January 2022 breach is Thomas v. CDCR, which is settled. CDCR is a party to other long-running cases about prison conditions, but those are separate and pay nothing for this breach.
What is the CDCR class action lawsuit case number?
Thomas, et al. v. California Department of Corrections and Rehabilitation, Case No. 34-2022-00328693-CU-PO-GDS, Superior Court of California, County of Sacramento, Department 23, Judge Jill H. Talley.
Did CDCR admit it did anything wrong?
No. CDCR denied the claims and said there was no indication any data was copied or downloaded. The court's final order states that the settlement is not an admission or a finding of wrongdoing.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Open Class Action Settlements
Settlements still taking claims, with deadlines
Data Breach Settlement Calculator
Estimate what a data breach settlement may pay per person
Settlement Check Problems
Lost, expired or never-arrived settlement checks
Class Action Payout Calculator
How fees and claim rates shape a per-person payout