What Counts as Documented Losses in a Data Breach Settlement

Data breach settlements often offer two kinds of money: a smaller payment almost anyone in the class can claim, and a larger reimbursement for “documented losses.” The second one is where people get stuck. What counts as a loss? What proof is enough? And what if you didn’t keep receipts?

The short answer: documented losses are generally money you actually spent or lost because of the breach, after it happened, that hasn’t been paid back by anyone else, backed by documents that didn’t come from you. Each settlement defines the details in its own claim form and settlement agreement, so the official settlement website is always the final word. This guide explains what those definitions usually include, using two real settlements as examples, and how to keep records that would hold up.

First: is there actually a settlement?

A data breach notice, a news story, or a lawsuit being filed doesn’t mean anyone can claim money. A claim process only exists once a settlement is reached and a court is overseeing it. Until then, there are no claim forms, no deadlines, and no payments.

• Check the notice itself first. Our guides to understanding data breach notices and verifying a data breach letter explain what a notice does and doesn’t promise.
• Follow verified case coverage in Lawsuits & Settlements and breach notices in our Breach Notice Tracker.
• If you get a settlement notice, find the official settlement website by searching the case name rather than clicking links in the email, and check that the case number matches (AARP).

If no settlement exists yet, the useful thing to do now is keep good records, which is what the rest of this guide is about.

What “documented losses” usually means

Settlements word this differently, but most documented-loss categories share four requirements.

1. It’s a real loss. Money you paid or lost, such as a fraudulent charge you weren’t refunded or a fee you paid to fix the damage.
2. It’s “fairly traceable” to the breach. The AT&T settlement, for example, required losses to be “fairly traceable” to the specific data incident (AT&T settlement FAQ).
3. It happened after the breach. The same settlement only covered losses incurred on or after the date of the relevant incident (AT&T settlement FAQ).
4. No one else paid it back. The Equifax settlement asked claimants in its extended period to certify they hadn’t already been reimbursed through other means (Equifax settlement FAQ).

What “reasonable documentation” usually means

This is the part that trips people up. In the AT&T settlement, reasonable documentation could include “receipts or other documentation not self-prepared by the Claimant.” Self-prepared documents were “by themselves, insufficient to receive reimbursement,” though they could add detail to other proof (AT&T settlement FAQ). Claimants also had to attest “under penalty of perjury” that they incurred the losses.

In practice: a bank statement showing the charge, a receipt, an invoice, or a letter from your bank, the IRS, or the police is the kind of proof that works. A spreadsheet you made yourself helps explain things, but it usually isn’t enough on its own.

Losses that often count, and the proof that usually works

These examples come from how past settlements have defined eligible losses. They aren’t a promise that any particular settlement will cover them.

Type of loss	Proof that usually works	Watch out for
Fraudulent charges or withdrawals you weren’t refunded	Bank or card statement, plus the bank’s letter denying or partly denying reimbursement	If the bank refunded you, it’s usually not a loss
Professional fees to fix identity theft, fraud, or a false tax return	Invoice and proof of payment from the accountant, attorney, or other professional	The work must relate to the breach-linked misuse
Postage, notary, copying, fax, mileage, and long-distance calls tied to fixing a loss	Receipts; mileage log tied to a specific appointment	Small items add up but each needs a record
Credit monitoring or identity protection you paid for after the breach	Receipt or statement showing the charge and date	Some settlements exclude it, or exclude it in later claim periods
Fees to replace documents or accounts	Receipt from the agency or business	Must be tied to the breach, not routine renewals
Time off work to deal with the misuse	Pay stub or employer letter showing unpaid leave	Often treated separately from out-of-pocket losses

The Equifax settlement’s list is a useful example of how broad these categories can be. It covered unreimbursed costs from identity theft, fraud, or falsified tax returns, miscellaneous expenses such as notary, fax, postage, copying, mileage, and long-distance calls, and professional fees for addressing the misuse. It also said other losses “fairly traceable to the Data Breach” might qualify (Equifax settlement FAQ).

What usually doesn’t count

• Losses someone already paid back, such as a fraudulent charge your bank reversed.
• Losses from before the breach, or that you can’t connect to it.
• Costs a specific settlement excludes. Equifax, for example, excluded the cost of freezing credit or buying monitoring during its extended claims period (Equifax settlement FAQ).
• Claims backed only by your own notes, when the settlement requires outside documentation.
• The same loss claimed twice. People in more than one class of the AT&T settlement had to use unique documentation for each claim (AT&T settlement FAQ).

Lost time, flat payments, and caps

Documented losses are usually just one option. Settlements often include other benefits with different rules.

• Lost time. Equifax paid $25 an hour for up to 20 hours. Up to 10 hours could be self-certified with a written description; more than 10 required documentation of misuse, such as a letter from the IRS or a bank, or a police report (Equifax settlement FAQ). Not every settlement offers this. The AT&T settlement FAQ doesn’t mention lost time.
• Flat or pro rata payments. Many settlements offer a cash payment that needs no proof of loss, paid from whatever is left after other claims. In the AT&T settlement, documented-loss payments came first and the remaining funds were split pro rata, in an amount “unknown at this time” when claims were filed (AT&T settlement FAQ).
• Caps. Every settlement sets a maximum. AT&T capped documented losses at $5,000 per person for one incident and $2,500 for the other. Equifax capped reimbursement at $20,000, including time (AT&T settlement FAQ; Equifax settlement FAQ).

Both of these settlements are closed to new claims. The AT&T claim deadline was December 18, 2025, and Equifax’s extended claims period closed January 22, 2024. They’re used here only to show how settlements define losses.

How to keep records that would hold up

You can’t know in advance what a future settlement will ask for, but the same habits cover almost any claim form, and they help with bank disputes and identity theft reports too.

5. Keep the breach notice and note the date of the breach. Our guide for when a breach exposed your Social Security number includes a list of what to keep and a simple time and cost log.
6. Save every receipt for money you spend dealing with the breach, and note what each one was for.
7. Keep the statement showing each fraudulent charge, and any letter showing whether it was reimbursed.
8. Keep letters from banks, the IRS, credit bureaus, and police. These are outside documents that settlements tend to accept.
9. Log time as you go: the date, what you did, and how long it took. It may only support other proof, but it’s far easier than reconstructing it later.

The Digital Evidence Checklist and our guide to preserving evidence of online fraud explain how to save statements and emails with their dates intact. If your information has actually been misused, start with our first steps after identity theft.

How to read a claim form

When a real settlement is announced, read the official claim form and FAQ for these points before you file.

• Who’s in the class and how the settlement defines the breach and its dates.
• The claim deadline. Late claims may not be accepted.
• Each benefit option, and whether choosing one rules out another.
• The documentation rules for documented losses and for lost time.
• The caps and whether payments may be reduced pro rata.
• The attestation. Many forms require you to confirm your claim under penalty of perjury, so claim only what you can support.
• When payments start. Payments generally wait until the court approves the settlement and any appeals are resolved (AT&T settlement FAQ).

Avoid settlement scams

• Never pay a fee to file a claim. Requests for processing or filing fees are a red flag (AARP).
• Be wary of requests for your Social Security or bank account number in an unexpected email or call.
• Check that the settlement website has court documents and deadlines, and look up the claims administrator’s phone number yourself rather than using one from the notice (AARP).

Frequently asked questions

What counts as a documented loss in a data breach settlement?

Generally, money you actually spent or lost because of the breach, after it happened, that no one else reimbursed, supported by documents such as receipts, statements, or letters. Each settlement defines the details in its own claim form.

Are my own notes enough to prove a loss?

Often not by themselves. Some settlements, such as the AT&T settlement, have said self-prepared documents alone are insufficient, though they can add detail to receipts or statements.

Can I claim money my bank already refunded?

Usually not. Settlements typically cover only unreimbursed losses, and some require you to certify you weren’t already paid back.

Can I get paid for time spent dealing with a breach?

Some settlements pay for lost time, sometimes with limited self-certification, but not all of them do. Check the specific settlement’s claim form.

I got a breach notice. Can I file a claim now?

Only if a settlement has been reached and its claim period is open. A breach notice alone doesn’t create a claim process. Keep your records so you’re ready if one is announced.

Does it cost anything to file a settlement claim?

No. Legitimate settlements don’t charge a fee to file, so a request for one is a warning sign.

Sources

• Telecom Data Settlement (AT&T), official settlement FAQ
• Equifax Data Breach Settlement, official settlement FAQ
• AARP, How to Tell if a Class Action Lawsuit Settlement Notice Is Real or a Scam

This guide is general information, not legal advice, and doesn’t mean any settlement is available to you. Read how we research and update our guides in our Editorial Standards, and see our Corrections Policy to report an error. More coverage: Data Breaches · Lawsuits & Settlements.