$190 Million Capital One Settlement for 98 Million Customers Whose Data Was Stolen in the 2019 Hack

In July 2019, Capital One disclosed that a former cloud-services engineer had exploited a misconfigured firewall to reach data the bank stored on rented servers, credit applications going back to 2005, containing names, addresses, credit scores, Social Security numbers, and linked bank account numbers. Roughly 100 million people in the United States were affected. Unlike breaches blamed on foreign intelligence services, this one traced to a single hacker and a configuration error, which made the question of corporate negligence unusually pointed.

Dozens of class actions were consolidated into a multidistrict litigation before the Eastern District of Virginia, the famously fast 'rocket docket' sitting a few miles from Capital One's McLean headquarters. The court appointed a small leadership group to run the plaintiffs' case, naming John Yanchunis of Morgan & Morgan's complex litigation group co-lead class counsel alongside Norman Siegel and Karen Hanson Riebel, a direct product of the credibility Yanchunis had built leading the Yahoo breach litigation.

The case was litigated hard rather than settled early. The plaintiffs survived dismissal motions, won contested discovery fights, including a notable ruling forcing Capital One to turn over its internal forensic incident report, and pushed the case to the brink of class certification briefing before the bank came to terms. That pressure showed in the result: a $190 million cash fund, agreed in late 2021, on top of the $80 million penalty banking regulators had separately imposed on Capital One for the same security failures.

Judge Anthony Trenga granted final approval in September 2022. The fund reimbursed out-of-pocket fraud losses and lost time for a class of about 98 million people and paid for years of identity-defense and restoration services, the kind of concrete, non-reversionary relief that had become Yanchunis's signature demand since Yahoo. Bloomberg Law reported the court's fee award to class counsel at $53.2 million, a figure the court found proportionate to a recovery it ranked among the largest ever in a data breach case.

Capital One slotted in behind Equifax and alongside T-Mobile in the top tier of American data breach settlements, and it confirmed that the playbook Morgan & Morgan's privacy team ran was repeatable: consolidate, litigate to the courthouse steps, and price the loss of 98 million people's data in nine figures.