DocketX / When someone wronged you Fired, laid off, unpaid / My data was in a breach, now what

My data was in a breach, now what

You received a letter or email from a company saying your personal information, like your name, Social Security number, or financial details, was exposed in a data breach. It can feel unsettling, even violating, because you didn’t cause this, and now you’re left wondering what will happen next. The good news is that you have a real, ordered set of options to consider, from monitoring your accounts to exploring legal recourse, depending on the specifics of your situation.

The honest reality

Not every data breach leads to a successful legal claim. The key difference between a bad experience and a viable case is whether you suffered actual, concrete harm, such as identity theft, fraudulent charges, or out-of-pocket costs, that you can trace directly to the breach. A breach notification alone, without any resulting harm, generally does not provide a basis for a lawsuit, though it may still be worth reporting to regulators.

Your real options, cheapest first

1. Free: complain to the regulator. Reporting a breach to the FTC is free and feeds a database regulators use to build cases against companies with a pattern of poor security. the Federal Trade Commission and your state Attorney General is where to start.
2. A demand letter. Take the free credit monitoring the company offers, freeze your credit with all three bureaus regardless, and keep the breach notice; it's your proof of when and what was exposed.
3. Small claims court. Individual breach lawsuits rarely work well alone; most meaningful compensation for consumers after a breach comes through class action settlements, which you don't have to sue to join. No lawyer required; see our pro se guide.
4. A lawsuit. Watch for a class action settlement tied to the specific breach; if you suffered an actual, documented loss, like fraudulent charges tied to the breach, that is a stronger individual claim than the exposure alone.

You don't need a lawyer to start

You are allowed to do this yourself

A regulator complaint, a demand letter, and small claims court are all built for people without lawyers. Read our pro se guide for how self-representation actually works, our small claims guide for that specific process, and if a lawyer's cost is the blocker at any stage, our can't-afford-a-lawyer triage covers every free and low-cost path, including legal aid.

Questions

Can I sue the company for the breach?

You may be able to sue if you can prove that the company failed to protect your data and that you suffered actual financial or emotional harm as a direct result. Many people join class-action lawsuits that are filed after a breach, but individual lawsuits are more difficult and often require a lawyer to evaluate whether your specific harm is enough to proceed.

What compensation can I realistically get?

Compensation depends on the harm you can prove, such as reimbursed fraud losses, credit monitoring costs, or time spent dealing with the breach. In some cases, settlements from class actions provide small cash payments or free services like credit monitoring, but large payouts are rare unless you have clear, documented losses.

Do I need to hire a lawyer right away?

Not necessarily. You can start by taking free steps like freezing your credit, monitoring your accounts, and reporting any suspicious activity. If you have suffered significant harm or want to explore a lawsuit, consulting a lawyer can help you understand your options, but watch for any deadlines that may apply, as time limits vary by state.

Not legal advice and not a law firm. We don't predict outcomes, and deadlines and dollar thresholds vary by state and by claim, check your state's page before you rely on any number. If you can get a lawyer or free legal aid, do: start at lsc.gov.