How to Document Out-of-Pocket Losses After a Data Breach
Documented losses can be worth far more than the flat cash option in a data breach settlement. Here's what counts and how to build the paper trail.
To document out-of-pocket losses after a data breach, keep a receipt, statement or invoice for every cost you paid because of the breach, write down the date and reason for each one, and save any communication showing the link to the breach. Data breach settlements commonly offer reimbursement for documented losses up to a cap, and claims are reviewed against those records. The stronger and more organized your paper trail, the better your chance of approval.
What usually counts as an out-of-pocket loss
Each settlement defines eligible losses, but they commonly include costs that are fairly traceable to the breach, such as:
- ✓Unreimbursed fraudulent charges on your accounts.
- ✓Fees to freeze or unfreeze your credit, where they apply, or to order credit reports.
- ✓Costs of credit monitoring or identity theft protection you bought after the breach.
- ✓Fees to replace a driver's license, passport or other ID.
- ✓Bank fees, like overdraft or late fees, caused by fraud.
- ✓Postage, notary, and phone or mileage costs incurred dealing with fraud.
- ✓Professional fees, such as an accountant or attorney, to resolve identity theft.
Some settlements also compensate time spent dealing with the breach, which is usually a separate category. See our guide on claiming lost time.
What usually doesn't count
- ✓Losses that were already reimbursed by your bank or card issuer.
- ✓Costs incurred before the breach happened.
- ✓Expenses without any documentation.
- ✓General inconvenience or worry, which is typically covered, if at all, by a flat payment.
How to build your paper trail
- 1Save the breach notice. It shows you were affected and when you found out.
- 2Keep every receipt. Digital receipts and order confirmations work. Screenshot anything that might disappear.
- 3Download statements. Highlight fraudulent charges and fees on bank and card statements.
- 4Record what you did and why. A simple log with date, action, cost and connection to the breach helps reviewers.
- 5Keep correspondence. Emails or letters from your bank, the credit bureaus, or police and FTC identity theft reports.
- 6Note reimbursements. If your bank refunded part of a charge, record that too, since only unreimbursed amounts usually qualify.
Settlements can take years to arrive. By then, receipts are lost and statements are hard to retrieve. If you get a breach notice, open a folder that day and add to it as you go. Our guide to what to do after a breach notice lists first steps.
Showing the loss is linked to the breach
Administrators often ask whether the loss is fairly traceable to the specific breach. Timing helps: a fraud charge shortly after the breach using the type of information that was exposed is more persuasive than one from years earlier. If several breaches exposed your data, you may need to explain why a loss relates to this one. Settlements usually apply a reasonable standard, but be clear and honest.
Filing the claim
- ✓Upload clear copies, not originals, and keep your originals.
- ✓Fill in every amount, date and description the form asks for.
- ✓Make sure totals on the form match your documents.
- ✓Watch for a deficiency notice afterward, which may give you a short window to fix gaps.
Many breach settlements let you choose between documented losses and a flat cash payment, and some let you claim both categories. Compare your documented total with the flat option before choosing, and read the rules in the claim form.
Open data breach settlements
Jefferson County Health Center Data Breach Settlement — $150 or Up to $300
MO Data Breach Jefferson County Health Center Data Breach Settlement — $150 or Up to $300 $150 with no documentation, or up to $300 for documented losses, for Missouri residents whose health information was exposed in the 2022 breach.
Dartmouth $750,000 Data Breach Class Action Settlement
Individuals who received notice from Dartmouth about a 2025 data breach may be eligible to claim up to $5,000 from a class action settlement.
Highlands Oncology Group - Data Breach Class Action Settlement
You may be included in this settlement if your private information was compromised in the June 2025 Highlands Oncology Group data breach.
EFS Advisors & Aviben Data Breach Settlement — $50 or Up to $2,500
Palomar Health Data Breach Settlement — About $60 or Up to $5,000
Americold $5.25M Data Breach Class Action Settlement
Showing 6 of 70. Updated daily from the SettleScout catalogue. See every open settlement.
A simple folder structure
Organization makes claim time much easier. One approach is a single folder per breach, with subfolders for the notice, receipts, statements and correspondence, plus a running spreadsheet of costs. Name files with the date and a short description so you can match them to the claim form quickly. If you were affected by several breaches, keep them separate so each claim only includes the costs tied to that breach.
Keep the folder even after you file. Administrators sometimes ask follow-up questions, and the same records may help if a later breach involves the same accounts.
If you are unsure whether a particular cost qualifies, the claim form instructions and the settlement FAQ usually list examples, and the administrator can answer general questions about eligible categories.
SettleScout matches you with data breach settlements based on the companies you use and reminds you before each claim deadline, so your documented losses don't go unclaimed. You can also browse the data breach category.
Frequently Asked Questions
What counts as an out-of-pocket loss in a data breach settlement?
Commonly, unreimbursed fraud charges, credit freeze and report fees, credit monitoring you paid for, ID replacement fees, related bank fees, and professional fees. Each settlement defines eligible losses, so check the claim form.
What documents do I need for a data breach loss claim?
Receipts, invoices or statements showing the cost, plus anything that ties it to the breach, such as the breach notice, bank correspondence or identity theft reports.
Can I claim losses that my bank already refunded?
Usually not. Most settlements reimburse only unreimbursed losses. Note any refunds when you file.
See every settlement you qualify for
Tell SettleScout which brands you use. It finds your matches, estimates your payouts and reminds you before deadlines.
Free to download