The deadline for claiming a share of the bank’s massive data-breach settlement is drawing near.
In March 2019, more than 100 million Capital One banking customers had personal information exposed in a huge data breach. The payback for victims of that hack will soon arrive, as Capital One’s proposed $190 million settlement is set to receive final approval in mere weeks.
Plaintiffs in a class-action lawsuit claim a hacker couldn’t have broken into the bank’s cloud computing systems, hosted by Amazon, if the company had taken adequate protections. They say Capital One “knew of the particular security vulnerabilities that permitted the data breach, but still failed” to protect customers, putting millions at risk of fraud and identity theft.
Neither Capital One nor Amazon responded to a request for comment.
Capital One hasn’t admitted any wrongdoing but agreed to a $190 million settlement in December 2021, “in the interest of avoiding the time, expense and uncertainty of continued litigation.” The US District Court for the Eastern District of Virginia granted preliminary approval for the deal on Jan. 31, 2022 (PDF).
At that time, prospective class members had until Aug. 22 to file a claim. That deadline has now been extended to the end of September.
Here’s what you need to know about the Capital One data breach settlement, including how to find out if you’re eligible for a payout, how much money you could receive and the deadline for filing a claim.
For more on class-action cases, find out if you’re eligible for money from T-Mobile’s $350 million data breach case, Apple’s $14.8 million iCloud storage settlement or Facebook’s $90 million data-tracking payout.
What happened in the 2019 Capital One data breach?
In one of the largest financial security breaches in US history, a hacker accessed the personal information of approximately 106 million Capital One customers and applicants in March 2019.
The massive hack went undiscovered for approximately four months before Capital One made it public in July 2019.
Seattle engineer Paige Thompson, a former Amazon cloud employee, was ultimately arrested in connection with the case. In June, she was convicted of wire fraud and unauthorized access and damages to a protected computer.
Capital One said Thompson illegally gained access to personal information related to credit card applications dating between 2005 and early 2019 for both personal and small-business accounts.
“With some of her illegal access, she planted cryptocurrency mining software on new servers with the income from the mining going to her online wallet,” the Department of Justice said in a release, adding that Thompson used an alias to brag on social media and online forums about masterminding the attack.
Thompson is scheduled for sentencing on Sept. 15.
In addition to the $180 million class action lawsuit, Capital One was fined $80 million and agreed to enhance its cloud security standards.
Capital One said it immediately fixed its servers’ vulnerability to forged requests when it became aware of the breach.
What was exposed in the Capital One hack?
Capital One said about 140,000 Social Security numbers and 80,000 US bank account numbers were exposed, as were birth dates, addresses, phone numbers, credit balances, transactions and credit scores.
An additional 1 million Canadian credit card customers and applicants had their Social Insurance Numbers stolen.
No login information or credit card account numbers were obtained by Thomas, the bank said.
Who is eligible for payment from the Capital One data breach settlement?
Some 98 million applicants and cardholders are eligible to file a valid claim, according to Capital One. The company said it sent letters and emails to members whose Social Security numbers or bank account numbers were exposed in the hack.
Read more: Data Breaches Up in First Quarter of 2022
How much can I receive from the Capital One settlement?
Class members can collect up to $25,000 in cash for lost time and out-of-pocket expenditures relating to the breach, including unreimbursed fraud charges, money spent preventing identity theft and fees to professional data security services.
You can claim up to 15 hours of lost time spent addressing the issue, at a rate of at least $25 per hour.
The settlement also provides three years of free identity protection services through the Pango Group, including identity monitoring, lost wallet protection, security freeze capabilities, dark-web monitoring, free account restoration, and $1 million in identity theft and fraud insurance.
How do I file a claim in the Capital One data breach case?
You can file online at the class action settlement website. You’ll need the Unique ID and PIN printed on the notice you received from Capital One in the mail or via email.
If you think you are eligible but didn’t receive a notice (or lost it), you can contact the Settlement Administrator at 855-604-1811 for help.
Valid claims require detailed documentation, including receipts, bank statements, voided checks and invoices.
What is the deadline to file a claim?
The original deadline to file a valid claim in the Capital One case was Aug. 22. That deadline has been extended to Sept. 30.
The deadline for exclusion from the settlement in order to retain the right to pursue separate legal action was July 7.
When will class members receive their payments?
A judge has given preliminary approval for the $180 million settlement. A final approval hearing was initially slated for Aug. 19 but was rescheduled to Sept. 8.
Assuming the settlement receives final approval then, and there are no appeals, checks could be sent out soon after. We’ll keep you updated as new information is made available.
First published on Aug. 16, 2022 at 5:00 a.m. PT.
Article by: Dan Avery
Photo Info:
Capital One customers have until Sept. 30 to file claims for compensation relating to the 2019 data breach.
NurPhoto/Getty Images
Vintage Dava 