How to Join a Data Breach Class Action Lawsuit

Marisa Glassman is an attorney in Morgan & Morgan’s Complex Litigation Group. Her practice focuses on complex litigation, class actions, and consumer protection—including data breach lawsuits. Ms. Glassman is currently co-liaison counsel for consumer plaintiffs in the Arby’s Restaurant Group, Inc. Data Security Litigation.

Below, she answers questions consumers often have about data breach lawsuits.

How do I join a data breach class action lawsuit?

If your information was compromised in a data breach and a class action lawsuit has already been filed for that breach, typically you don't need to do anything to join the lawsuit.

You don't need to do anything to join the lawsuit.

The named plaintiffs who filed the complaint are suing on behalf of themselves and others whose information was also compromised as a result of the data breach. As a class member, you should be automatically included in the lawsuit and do not need to do anything to participate in the case.

What types of damages can I recover in a data breach lawsuit?

Previous data breach class action lawsuit settlements have included relief such as credit monitoring, fraud resolution services, and reimbursement for out-of-pocket losses resulting from the data breach. Typically monetary damages are limited to reimbursing class members for their out-of-pocket losses resulting from the data breach, for example reimbursement for time spent having to resolve the fraudulent use of your identity. But each case is different and damages may vary.

Another component of data breach settlements has been the defendant agreeing to create data security policies to protect your information from future data breaches.

How will I know if there is a data breach lawsuit settlement?

When a data breach class action case resolves, a settlement notice will be used to inform class members of the settlement. The settlement notice will describe the terms of the settlement and the rights of the class members under that settlement. Notices may be mailed, e-mailed, or published in a magazine, newspaper, or online.

In the event of a settlement, how do I recover for my claims?

You must submit your claim to receive your portion of the settlement.

If a class action data breach case has settled, you will need to claim your portion of the settlement. A claim form is a court-required document that all class members must file to participate in a court-approved settlement. Instructions should be included with the notice and claim form on how to complete your claim.

You must submit your claim to receive your portion of the settlement.

What if there are several complaints filed over the same breach?

After a large data breach that affects hundreds of thousands or millions of individuals, such as the Equifax data breach, it is typical that many law firms will file similar complaints. This is because different individuals contact and retain different law firms to pursue the same matter.

Generally, the cases will be consolidated and heard by the court as one lawsuit. The court will determine which law firms will lead the litigation.

Are there different types of data breach lawsuits?

Each data breach case is different. Data breaches may contain different types of compromised information and different circumstances for how the information was compromised.

For example, some data breach cases involve only payment cards data, while other breaches include social security numbers or healthcare related information. Some breaches occur over many months or years, while some last shorter amounts of time. Payment card or computer systems may be breached by cybercriminals, or employers may fall for email phishing scams and send employees’ W-2 information to cybercriminals.

Our attorneys have experience with a wide variety of data breach litigations. If you believe your information was compromised in a data breach, we can investigate your facts to determine whether a class action lawsuit may be appropriate.

How long does a data breach class action take?

Each case is different, but a data breach class action case will typically take 1-3 years.

How can I protect my information after a data breach?

There are several steps you can take to protect your identity from being misused following a data breach:

• Check and monitor your credit reports. Accounts or activity that you don’t recognize could indicate identity theft.
• Monitor your existing credit card and bank accounts closely for charges you don’t recognize.
• You may consider placing a fraud alert on your files. A fraud alert warns creditors that you may be an identity theft victim and that they should verify that anyone seeking credit in your name really is you.
• Also, file your taxes as soon as you have the tax information you need, before a scammer can fraudulently file a return in your name. Tax identity theft happens when someone uses your Social Security number to get a tax refund or a job. Respond immediately to letters from the IRS.
• You may want to set up a freeze on the websites of all three credit bureaus: Transunion, Equifax, and Experian. But there may be fees associated with doing so. (If you’re married, both you and your spouse should freeze your files, since the companies maintain separate files for every adult that they track.)

Fraudulent misuse of your identity may not happen immediately after a data breach. Criminals may wait months or years to misuse your data, so it's important to continue to monitor and review your information to identify any potential fraud.