For U.S. consumers, there isn't one nationwide data-breach refund deadline. A payment deadline exists only when a particular settlement, court notice, or other legal process creates a claim. That process sets the date, eligibility rules, and required proof.

A breach notification by itself usually means that your information may have been exposed. It doesn't promise a refund or compensation. Depending on the case, a payment may be called reimbursement, a cash award, or a settlement payment. Eligibility often turns on the type of loss and the records you can provide.

Four dates that are easy to confuse

Date or deadline What starts it What it means
Breach notification A company or agency confirms an incident Tells you about possible exposure; it isn't necessarily a payment deadline
Regulatory reporting A business reports an incident to a regulator Supports regulatory oversight but doesn't automatically create a consumer claim
Settlement claim A court-approved notice or claims administrator opens a process Tells eligible people when and how to submit a claim
Individual legal claim The facts and law governing your loss May have a separate limitation period that depends on the state and type of claim

The settlement claim deadline is usually the date that matters most to someone seeking a payment. It may not match the deadline to object to the settlement or opt out of it. Missing one of those dates can have different consequences, so don't treat them as interchangeable.

For federal class actions, Federal Rule of Civil Procedure 23 provides the procedural framework for class certification and settlement approval. It doesn't establish one deadline for every data breach in the country.

What a legitimate settlement notice should tell you

Read the notice before relying on a social media post, news report, or law firm advertisement. The notice should identify:

Use the website printed in the notice. When a notice arrives by email or text, verify the site independently before entering personal information. An unsolicited caller who mentions a real breach still isn't entitled to your password, Social Security number, or payment details.

Equifax settlement deadlines have passed

The 2017 Equifax breach affected approximately 147 million people. The official Equifax Data Breach Settlement website lists the relevant claim deadlines as passed:

There isn't a general Equifax settlement claim window open in 2026. People who filed a claim can use their claim number and the official settlement website to check available information. If you never filed, don't assume that a new payment is available simply because you were affected by the breach.

The District of Columbia Attorney General's guidance also identifies January 22, 2020, as the original deadline and describes the credit-monitoring benefits connected with the settlement.

Change Healthcare and other breach notices

A Change Healthcare incident notice is not the same as a consumer settlement notice. The District of Columbia government information page describes disruption to some insurance-claim and pharmacy-benefit activity and warns that scammers may pose as healthcare representatives.

After receiving a Change Healthcare notice:

  1. Keep the letter or email, including its envelope if it arrived by mail, and note when you received it.
  2. Follow the instructions in the notice or on a court-approved administrator's website.
  3. Look for a settlement name, case number, claim number, eligible loss period, and filing deadline.
  4. Ask the administrator about unclear eligibility or deadline language using the contact information in the notice.
  5. Don't use the cyberattack date, a regulatory filing date, or a company's reported response cost as your consumer claim deadline.

The same point applies to MOVEit, SolarWinds, 23andMe, and other incidents. An incident name doesn't establish that a consumer settlement exists or that a claims portal is open. The Kroll 23andMe restructuring page concerns Chapter 11 administration; by itself, it isn't evidence of a current data-breach compensation deadline.

Filing a claim before the deadline

Check the class definition first

Compare the notice with your own records. A settlement may cover only residents of certain states, customers during a defined period, or people whose particular types of information were exposed.

Match your loss to the proof requirement

Create a file with the documents the notice may require, such as:

Send only what the administrator requests. Follow its rules for acceptable documents, and redact unrelated account numbers when the instructions allow it.

Use the approved filing method

Complete all required fields and check your name, address, and contact details before submitting. For an online claim, save the confirmation page and take a screenshot. For a mailed form, keep a copy and follow the notice's postmark instructions. Use tracked delivery if the notice recommends it.

Keep the confirmation number, submitted documents, and follow-up messages together. Don't submit duplicate claims unless the administrator directs you to replace or correct an earlier filing.

An administrator may request more information or mark a claim incomplete. Use the written correction or appeal procedure in the notice, and watch for any separate response deadline.

What happens if you missed the deadline?

A late claim isn't automatically accepted. Contact the official claims administrator promptly and ask whether it can:

Ask for the answer in writing. A general statute of limitations doesn't, by itself, reopen a closed settlement or give you a right to join it. An individual lawsuit is a separate issue. Its deadline may depend on your state, the type of harm, when you discovered the problem, and the settlement's release terms. For a substantial loss, consider speaking promptly with a licensed attorney or reputable legal-aid service.

Don't create receipts, inflate a loss, or submit someone else's information. False documentation can result in denial and other consequences.

Protecting your credit while you check

A settlement claim and identity-theft protection address different problems. When exposed information could be used to open accounts, these steps may help:

A freeze or fraud alert won't submit a settlement claim. It also doesn't replace reporting unauthorized activity to your bank or card issuer.

Frequently asked questions

Is a data-breach refund automatic?

No. A company or settlement may offer monitoring, reimbursement, or another remedy, but you generally must meet the notice's eligibility and filing requirements.

Can I file an Equifax claim now?

The original Equifax settlement deadline was January 22, 2020, and the extended claims period ended January 22, 2024. Both dates have passed. Use the official settlement site to review an existing claim or confirm settlement information, not to assume that a new claim window is open.

Does a breach notification include a compensation deadline?

Not necessarily. The notice may only describe the exposed information and protective steps. A separate settlement notice, case number, or claims-administrator instruction is usually what identifies a payment claim and its deadline.

Can I submit a late claim?

Sometimes an administrator has a correction or review process, but there's no general right to file late. Contact the official administrator immediately and keep its written response.

If you received a breach notice, save it, verify any administrator website independently, and put the stated claim deadline on your calendar before gathering your records.