Data Breach Laws
79 articles · page 1 of 2
#
23andMe Data Breach Settlement: Payments Expected September 2026
23andMe's claim window closed Feb 17, 2026 and final approval came Jan 30, 2026. The administrator now expects class member payments in September 2026.
A
Alabama Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Learn Alabama's data breach notification rules under the 2018 Act, including the 45-day deadline, AG reporting requirements, penalties, and exemptions.
Alaska Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Alaska requires breach notification without unreasonable delay. One of ~12 states with a private right of action for actual damages up to $500.
ApolloMD Data Breach Settlement: Who Is Eligible, Payout
ApolloMD data breach settlement: the Sept 30, 2026 claim deadline has passed. The $4.02M deal has a final approval hearing scheduled for Oct 5, 2026.
Arizona Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Arizona requires data breach notification within 45 days under A.R.S. §§ 18-551 and 18-552. Learn who must report, what triggers notice, and penalties up to $500,000.
Arkansas Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Learn Arkansas data breach notification rules under the Personal Information Protection Act, including reporting timelines, AG requirements, and penalties.
AT&T Data Breach Settlement: Final Approval Granted October 2, 2026
A federal judge granted final approval of AT&T's $177M data breach settlement on October 2, 2026. Claims closed Dec 18, 2025 and the order sets no payment date.
C
California Data Breach Notification Laws: Reporting Rules & Timelines (2026)
California requires breach notification within 30 days under SB 446. Learn who must comply, what triggers notice, CCPA damages, and AG reporting rules.
Cash App Data Breach Settlement: Approved, Not Yet Paid
The $15M Cash App data breach settlement has final approval but is not confirmed paid. Claims closed Nov 18, 2024; see the status and the payout tiers.
Change Healthcare Data Breach Settlement: No Settlement Yet
As of September 2026 there is no Change Healthcare settlement, fund, or claim form. MDL 3108 is in pretrial; the next status conference is September 17, 2026.
Colorado Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Colorado requires data breach notification within 30 days. Learn who must comply, what personal information is protected, AG reporting rules, and penalties.
Comcast Xfinity Data Breach Settlement: How to Claim
Comcast's $117.5M Xfinity data breach settlement is open through Sept. 14, 2026. File free at the official site, no proof needed for the cash option.
Connecticut Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Connecticut requires 60-day breach notification, 24-month credit monitoring for SSN breaches, and AG reporting. Learn the rules under Conn. Gen. Stat. 36a-701b.
D
Delaware Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Delaware requires data breach notification within 60 days. Learn who must comply, what data triggers reporting, AG notice rules, and encryption safe harbor.
District of Columbia Data Breach Notification Laws: Reporting Rules & Timelines (2026)
DC requires breach notification without unreasonable delay and AG notice when 50+ residents are affected. Learn about the private right of action, 18-month identity theft protection, and penalties.
E
Esse Health Data Breach Settlement: Approved, Not Yet Paid
The Esse Health data breach settlement has final court approval and no payment date yet. Simpluris posts updates; the free protection codes activate September 12, 2026.
Evolve Bank & Trust Data Breach Settlement: Paid in 2026
The Evolve Bank & Trust data breach settlement is paid. Checks went out March 30, 2026. Here is who was covered and what people actually got.
F
Fidelity Breach Settlement: Claim Window Closed, Approval Pending
Fidelity's data breach claim window closed July 27, 2026, and the July 9 final approval hearing has been held. Simpluris and the Massachusetts federal court post updates.
Flagstar Settlement: Approved, Not Yet Paid
The Flagstar data breach settlement received final court approval on October 5, 2026 and no payment date has been set. Status updates come from the court and the administrator, EisnerAmper.
Florida Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Learn Florida's 30-day data breach notification deadline, penalty structure up to $500,000, AG reporting rules, and encryption safe harbor under Fla. Stat. 501.171.
G
Georgia Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Georgia's data breach notification law requires notice without unreasonable delay but sets no deadline, no AG reporting, and no penalties. Full breakdown of Ga. Code 10-1-912.
GRIPA MOVEit Settlement: Claim Window Closed, Hearing Nov 12, 2026
GRIPA's MOVEit claim window closed September 3, 2026, and the final approval hearing was rescheduled to November 12, 2026. The official site posts status updates.
H
How to Freeze Your Credit After a Data Breach (Free)
A credit freeze is free at Equifax, Experian, and TransUnion by federal law. Step-by-step for all three, plus freeze vs. fraud alert vs. lock.
I
Idaho Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Learn Idaho data breach notification rules, the 24-hour agency reporting deadline, protected data categories, encryption safe harbor, and penalties up to $25,000.
Illinois Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Learn Illinois data breach notification rules under 815 ILCS 530, including reporting timelines, AG notification thresholds, encryption safe harbor, and penalties.
Indiana Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Indiana requires data breach notification within 45 days. Learn who must be notified, what personal information triggers the law, penalties up to $150,000, and the biometric data gap.
K
Kansas Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Kansas requires businesses to investigate breaches and notify residents without unreasonable delay under K.S.A. 50-7a01. Learn about PI definitions, safe harbors, and penalties.
Kentucky Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Learn Kentucky data breach notification requirements under KRS 365.732 and government rules under KRS 61.931-934, including timing, encryption safe harbor, and penalties.
L
Labcorp AMCA Settlement: Claim Window Closed, Awaiting Approval
The $35M Labcorp AMCA claim window closed September 3, 2026, after the August 20 final approval hearing date. Kroll and the New Jersey federal court post status updates.
Lands' End Settlement: Claim Window Closed, Final Hearing Nov 6, 2026
The Lands' End data breach claim window closed October 22, 2026. A final approval hearing is set for November 6, 2026; status updates come from the court and the administrator, Simpluris.
LastPass Settlement: Claim Window Closed, Awaiting Approval
LastPass's claim window closed July 2, 2026. No final approval order as of September 9, 2026 and no payment date set. Updates come from the court and the administrator.
Lee University Settlement: Claim Window Closed, Hearing Sept 30
Lee University's claim window closed August 19, 2026. The final approval hearing is set for September 30, 2026 in Chattanooga; the court and Kroll post status updates.
Lemonade Settlement: Approved, Not Yet Paid
A federal judge granted final approval of the Lemonade data breach settlement on September 10, 2026 and no payment date has been set; status updates come from the court and the settlement administrator.
Louisiana Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Louisiana requires data breach notification within 60 days. Learn who must report, what data is protected, AG reporting rules, and penalties under La. R.S. 51:3071.
M
Maine Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Maine requires data breach notification within 30 days. Learn who must comply, what triggers notification, encryption safe harbors, and penalties under state law.
Marlboro-Chesterfield Settlement: Claim Window Closed, Oct 12
The Marlboro-Chesterfield Pathology claim window closed August 21, 2026. A final approval hearing is set for October 12, 2026; the court and Kroll post status updates.
Maryland Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Maryland requires data breach notification within 45 days. Learn about AG-first reporting, protected personal information, encryption safe harbors, and penalties.
Massachusetts Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Learn Massachusetts data breach notification rules under Chapter 93H and 201 CMR 17.00, including WISP requirements, penalties, and credit monitoring obligations.
Michigan Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Michigan data breach notification law requires businesses to notify residents of security breaches involving personal information. Learn timelines, penalties, and safe harbors under MCL 445.72.
Minnesota Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Minnesota requires breach notification without unreasonable delay when names plus SSNs, driver's licenses, or financial accounts are exposed. No AG notice required.
Mission Community Hospital Settlement: Claims Closed, No Ruling Yet
The Mission Community Hospital (Deanco Healthcare) claim window closed August 12, 2026. The final approval hearing was held September 9, 2026 and the court has not ruled.
Mississippi Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Mississippi data breach notification law (Miss. Code 75-24-29) requires notice without unreasonable delay. No AG reporting required. Learn triggers, exemptions, and penalties.
Missouri Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Missouri data breach notification law (Mo. Rev. Stat. 407.1500) requires prompt notice to affected residents. Learn timelines, penalties up to $150K, and AG enforcement rules.
Montana Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Montana requires data breach notification without unreasonable delay under Mont. Code 30-14-1704. Learn who must be notified, protected data types, AG reporting rules, and penalties.
Motility Software Settlement: Approved, Not Yet Paid
The Motility Software claim window closed August 7, 2026 and the court entered final approval on August 19, 2026. No payment date is set yet; Epiq posts status updates.
Mt. Baker Imaging Settlement: Claims Closed, Awaiting Approval
Mt. Baker Imaging and Northwest Radiologists claims closed August 19, 2026. The August 21 hearing has been held; no final approval order is posted on the official site yet.
N
National Public Data Breach Settlement: No Claim Exists
No National Public Data breach settlement or claim form exists as of September 2026. The company's bankruptcy was dismissed. Here is what actually helps.
Nebraska Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Nebraska requires data breach notification without unreasonable delay under Neb. Rev. Stat. 87-801. Learn about broad PI coverage including biometrics, AG notification, and the cybersecurity safe harbor.
Nevada Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Nevada requires data breach notification without unreasonable delay under NRS 603A. Learn about protected data types, PCI DSS mandate, no AG notification requirement, and the encryption safe harbor.
New Hampshire Data Breach Notification Laws: Reporting Rules & Timelines (2026)
New Hampshire requires data breach notification as quickly as possible under RSA 359-C:20. Learn about AG pre-notification, the $5,000 substitute notice threshold, CRA reporting, and penalties.
New Jersey Data Breach Notification Laws: Reporting Rules & Timelines (2026)
New Jersey requires data breach notification in the most expedient time possible, with no fixed day-count deadline. Learn about the CFA private right of action, AG and State Police reporting, and penalties up to $20K.
New Mexico Data Breach Notification Laws: Reporting Rules & Timelines (2026)
New Mexico requires data breach notification within 45 days of discovery under N.M. Stat. 57-12C. Learn about biometric data coverage, AG reporting, HIPAA/GLBA exemptions, and enforcement.
New York Data Breach Notification Laws: Reporting Rules & Timelines (2026)
New York requires data breach notification within 30 days under the SHIELD Act. Learn who must be notified, safeguard requirements, and penalties up to $250K.
North Carolina Data Breach Notification Laws: Reporting Rules & Timelines (2026)
North Carolina requires breach notification without unreasonable delay. Violations are UDTP offenses with treble damages and a private right of action under N.C. Gen. Stat. 75-65.
North Dakota Data Breach Notification Laws: Reporting Rules & Timelines (2026)
North Dakota requires breach notification without unreasonable delay and AG notice at 250+ affected individuals. Penalties up to $5,000 per violation under N.D. Cent. Code 51-30.
O
Ohio Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Ohio requires data breach notification within 45 days. Escalating penalties reach $10,000/day. The Ohio Data Protection Act offers a cybersecurity safe harbor under ORC 1349.19.
Oklahoma Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Oklahoma requires breach notification without unreasonable delay. SB 626 (effective Jan 2026) adds biometric data, 60-day AG deadline, and $150K penalty cap.
Onsite Mammography Settlement: Approved, Not Yet Paid
The court granted final approval of the Onsite Mammography data breach settlement on September 22, 2026 and no payment date is posted yet; status updates come from the court and the settlement administrator.
Oregon Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Oregon requires data breach notification within 45 days. AG notice at 250+, CRA at 1,000+. Penalties up to $500,000 for continuing violations under ORS 646A.604.
P
Pennsylvania Data Breach Notification Laws: Reporting Rules & Timelines (2026)
Pennsylvania requires breach notification without unreasonable delay. The 2024 BPINA amendment adds AG notice at 500+, 12-month credit monitoring, and health insurance data coverage.