Consequences of a Data Breach: What Companies Pay and What You Can Get
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
The consequences of a data breach land in two places. The company faces regulators, investors, courts and, rarely, prosecutors. You face the risk of fraud — and a legal system that pays for harm you can show, not for fear. This guide uses real cases with dates: Equifax, Capital One, Uber, and 2026 actions by the FTC and HHS.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
The Short Answer
For the company, the main consequences are government penalties, orders to fix security, public disclosure duties and class action settlements. The money can be large. IBM's 2026 Cost of a Data Breach report puts the global average cost of a breach at $4.99 million, up 12% on the prior year and a record high.
For you, the main consequences are identity theft, fraudulent accounts and medical identity theft. The fastest protection is free: a credit freeze, which the FTC says costs nothing to place or lift and does not affect your credit score.
Compensation is possible, but usually only through a settlement — and it is usually modest per person.
Case Details
Several rules decide what happens after a breach:
Federal Trade Commission. The FTC brings cases when a company's security failures contradict its promises. On June 5, 2026 it finalized an order against Illuminate Education after a breach the FTC says exposed personal data of 10.1 million students. The order requires a data security program and deletion of unnecessary data, and bars the company from misrepresenting how quickly it will notify schools and students of breaches.
HHS Office for Civil Rights (health data). On April 23, 2026, OCR announced four HIPAA settlements after ransomware attacks affecting more than 427,000 people, totaling $1,165,000, each with a two-year corrective action plan, per a report by Paubox. The repeated finding was a failure to do an accurate and thorough risk analysis.
Bank regulators. On August 6, 2020, the OCC assessed an $80 million civil money penalty against Capital One for failing to assess risk before moving operations to the public cloud.
SEC (public companies). Under rules adopted July 26, 2023, a material cybersecurity incident must be disclosed on Form 8-K Item 1.05, generally within four business days after the company decides it is material.
Supreme Court. In TransUnion LLC v. Ramirez, No. 20-297, decided June 25, 2021, the Court held that only plaintiffs who were concretely harmed can sue for damages in federal court, and that the mere risk of future harm, standing alone, is not enough. It was a credit-report case, not a hack, but that is the exact question in a breach suit where nothing has been misused yet.
Where Things Stand (October 2026)
Individual compensation comes from class action settlements, case by case. Check whether a breach you were notified about has one on our open settlements list, or on our pages for specific cases such as National Public Data, Change Healthcare and Yahoo.
Are You Affected — and Can You Claim?
The usual proof is a notice letter or email from the company or from the vendor that held your data. Keep it: it lists which fields were exposed and identifies you as a class member if a settlement follows.
You do not need to join a lawsuit to be included in a class. If a settlement is approved, a court-appointed administrator publishes a claims website and sets a deadline.
Deadlines are real. In the Equifax settlement, the deadline to file a claim was January 22, 2024. People affected can still get free identity restoration help until January 2029, even without a claim, according to the FTC.
What Victims Have Actually Received
Divide a fund by a very large class and the per-person figure shrinks. That is why documented out-of-pocket losses usually matter more than flat payments. To estimate a specific settlement, use our data breach settlement calculator.
Government fines, by contrast, usually go to the government, not to you.
Landmark Consequences, Year by Year
- 1
July 2019 — Equifax Settles for Up to $700 Million
Global deal with the FTC, CFPB and 50 states and territories over the 2017 breach of 147 million people, with up to $425 million for consumers.
- 2
August 6, 2020 — Capital One Fined $80 Million
The OCC penalizes the bank for weak risk assessment before moving key systems to the public cloud.
- 3
June 25, 2021 — Supreme Court Decides TransUnion v. Ramirez
Only concretely harmed plaintiffs can sue for damages; a bare risk of future harm is not enough.
- 4
October 2022 — A Security Chief Is Convicted
A federal jury in San Francisco convicts Uber's former chief security officer of obstructing an FTC proceeding and concealing a felony over a 2016 breach.
- 5
July 26, 2023 — SEC Four-Business-Day Rule
Public companies must disclose material cybersecurity incidents on Form 8-K, generally within four business days of deciding they are material.
- 6
April–June 2026 — HHS and FTC Act Again
OCR announces four ransomware settlements on April 23; the FTC finalizes its Illuminate order on June 5.
Three Things to Watch For After a Breach
Breach news is bait. These are the patterns that follow real breaches:
“Claim your breach settlement” with no court behind it
A real settlement has a court-approved administrator and a site named in the official notice. Equifax, for example, told people legitimate emails would come only from two equifaxbreachsettlement.com addresses. A page asking for your full Social Security number before you can “check eligibility” is collecting data.
Calls posing as the FTC or a regulator
Regulators announce penalties; they do not phone victims to collect fees. The FTC says it will never demand money, make threats, tell you to transfer money, or promise you a prize.
Paid “breach protection” sold by phone
The most effective step — a credit freeze — is free at all three bureaus, and free for children under 16 too. Anyone charging you to “freeze” or “lock” your file after a breach is selling something you can do yourself.
Data Breach Consequences — Questions People Actually Ask
What are the consequences of a data breach for a company?
Government penalties, court-ordered security programs, disclosure duties for public companies and class action settlements. IBM's 2026 report puts the global average cost of a breach at $4.99 million. Equifax agreed to pay at least $575 million over its 2017 breach.
What are the consequences data breach victims actually face?
Mostly the risk of fraud: new accounts opened in your name, tax or medical identity theft, and phishing that uses your real details. The severity depends on which fields were exposed — a Social Security number is far more dangerous than an email address. Your notice letter tells you which fields were involved.
Can you lose your job over a data breach?
Yes, and in rare cases face prosecution. Uber's former chief security officer was fired and, in October 2022, convicted by a federal jury of obstructing an FTC proceeding and concealing a felony, after concealing a 2016 breach of about 57 million users' records. AP reported it was believed to be the first criminal prosecution of a company executive over a data breach.
Can I sue a company because my data was breached?
You can, but in federal court you must show a concrete harm. In TransUnion v. Ramirez (June 25, 2021), the Supreme Court held that the mere risk of future harm, standing alone, is not enough for damages. A risk that is imminent and substantial can still support a request to stop the harm.
What are the consequences and implications of inadequate cybersecurity?
Regulators punish the failure itself, not just the breach. HHS's four ransomware settlements of April 23, 2026 rested on missing risk analyses, per Paubox's report. The OCC fined Capital One $80 million for failing to assess risk before a cloud migration.
How much money do victims get from a breach settlement?
It varies widely. In the Equifax settlement up to $425 million was available for 147 million affected people, with the most money going to documented losses. Our data breach settlement calculator shows how fund size and claim rates change the per-person figure.
Does a company have to tell me about a breach?
Notification duties come from state law and sector rules. Delay itself is punished: the FTC alleged Illuminate failed to notify schools in a timely manner, and OCR found delayed breach notification in some of its 2026 ransomware cases. Public companies must also tell investors under the SEC rule.
What should I do right now if my data was exposed?
Freeze your credit at all three bureaus; per the FTC it is free and lasts until you lift it. Keep the notice letter. Watch bank, card and health insurance statements. Then check whether the breach has a settlement with an open claim deadline.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Open Class Action Settlements
Settlements still taking claims, with deadlines
Data Breach Settlement Calculator
Estimate what a breach settlement could pay you
T-Mobile Data Breach Settlement
A large telecom breach settlement, explained
Class Action Payout Calculator
How claim rates change the per-person payment