Data breach lawsuits: what they say and where each one stands
A data breach is when someone gets into a company's computer systems without permission and takes or views personal information about customers, patients or employees. Several lawsuits say companies including Avis, Comcast, Fidelity Investments, Krispy Kreme and Labcorp did not do enough to protect that information. These are allegations, and the companies may dispute them. This page lists each data breach lawsuit, what it alleges, and where it stands.
Open for claims now
These settlements are taking claims. Check who qualifies and the deadline on each one.
Claims closed
The deadline to file a claim has passed for these settlements.
- Avis Data Breach settlementAvis failed to secure customer data, exposing names, driver's licenses, credit cards, and birth dates of ~299,006 people in August 2024.
- Christian Dior settlementDior alledgedly failed to protect customer data, allowing hackers to access personal info (e.g., names, SSNs), exposing victims to fraud and identity theft.
- Circle K (Employee) Circle K Employee Data Breach settlementA cyberattack on Circle K's computer systems exposed employee names and Social Security numbers.
- Comcast Data Breach settlementComcast failed to timely patch the known Citrix Bleed vulnerability, letting hackers steal personal data of 30+ million customers.
- ConnectOnCall Data Incident settlementAn unknown attacker broke into the ConnectOnCall platform in 2024 and took private provider-patient messages.
- Fidelity Investments Fidelity Data Breach settlementFidelity failed to protect customer data, letting hackers steal SSNs and bank account numbers in a three-day breach in August 2024.
- Krispy Kreme Employees Krispy Kreme Employee Data Breach settlementKrispy Kreme suffered a cyberattack exposing employee SSNs, financial data, biometrics, and passport numbers — affecting current and former workers nationwide.
- Labcorp Data Breach Labcorp / AMCA Data Breach settlementPatients' personal and health information were exposed when Labcorp's collections vendor AMCA was hacked in 2018–2019.
- Lemonade Data Breach settlementLemonade exposed customers' personal information, including driver's license numbers, in a data breach between 2023 and 2024.
- Total Vision (California Residents Only) Total Vision Data Breach settlementA hacker accessed Total Vision's database, exposing patients' medical records and SSNs from an October 2020 breach.
What is a data breach?
Companies collect personal details to do business: names, birth dates, driver's license numbers, Social Security numbers, bank and card numbers, and for health providers, medical records and patient messages. A data breach happens when an outsider gets access to that information, for example through a hacking attack or a weakness in software the company or one of its vendors uses.
The lawsuits listed here say the companies did not take reasonable steps to keep this data safe. The claims differ by case. For example, the Comcast case says the company did not patch a known software flaw in time, and the Labcorp case concerns a billing collections vendor, AMCA, that the lawsuit says was hacked. Other cases involve employee records rather than customer records, such as the Circle K employee data breach case, which is against Gas Express, a franchisee that runs Circle K stores.
The Federal Trade Commission publishes a data breach response guide for businesses describing steps it recommends companies take after a breach, such as securing systems and notifying the people whose information was involved.
For people whose information may have been exposed, the FTC runs IdentityTheft.gov, which explains how to report identity theft and lists recovery steps, such as placing a fraud alert or credit freeze and reviewing credit reports.