USAA Data Breach Settlement: Eligibility and Payout

If you’re a USAA member who received a notice about a data incident back in 2021, you’re probably wondering whether your personal information was caught up in it and if there’s any compensation coming your way. A $3.25 million class action settlement has been reached to resolve claims tied to that incident, and this guide lays out exactly who qualifies, how to claim your share, and what to expect next.

Total settlement amount: $3,250,000 ·
Individuals affected: Approximately 22,000 ·
Year of breach: May 2021 ·
Deadline to file claim: April 7, 2025 (passed) ·
Settlement type: Class action

The table below summarizes the key settlement details.

What happened in the USAA data breach of 2021?

USAA, the financial services company serving military members and their families, experienced a cyberattack that came to light in May 2021. The incident compromised the personal information of roughly 22,000 members.

When did the breach occur?

• The official settlement site identifies the incident date as May 6, 2021 (USAA Data Incident Settlement official site).
• Lawsuits were filed later that year and consolidated into In re USAA Data Security Litigation.

What type of data was exposed?

• Names, addresses, bank account numbers, and Social Security numbers were among the data accessed without authorization (Security.org).
• Because financial and identity data were involved, the risk of fraud is elevated for affected members.

How many members were affected?

• Approximately 22,000 individuals had their personal information accessed (official settlement portal).

The implication: while 22,000 is a relatively small fraction of USAA’s total membership, the sensitivity of the exposed data means affected individuals need to remain vigilant about identity theft.

Who is eligible for the USAA payout?

The settlement class covers individuals whose personal information was accessed during the May 6, 2021 data incident. Not all USAA members qualify – only those who can demonstrate their data was involved.

How do I know if I was affected by the USAA data breach?

• If you received a breach notification from USAA, you are likely included in the class (settlement FAQs).
• You can also check your eligibility by contacting the claims administrator via the official website.

What if I didn’t receive a notice?

• According to the settlement FAQ, even without a notice you may still be eligible if you can prove your data was compromised in the May 6 incident (USAA settlement FAQs).

Are all USAA members included?

• No. Only those whose personal information was actually accessed in the incident are part of the class (official settlement portal).

The catch: if you didn’t receive a written notice and can’t prove your data was accessed, you may be left out of the settlement pool.

Is the USAA data breach settlement legit?

Yes. The settlement was approved by a federal court and is being administered by a court-appointed claims administrator. The official website, usaadatasettlement.com, is the authoritative source for all filings.

How is the settlement funded?

• USAA agreed to pay $3.25 million into a settlement fund to resolve all claims (USAA Data Incident Settlement official site).
• This is a common approach in class actions: the company pays a lump sum without admitting wrongdoing.

Is there a court overseeing it?

• Yes. The case is In re USAA Data Security Litigation, and a federal judge gave final approval on May 21, 2025 (Bloomberg Law).
• The settlement website and all notices were approved by the court.

Are there any scams related to this settlement?

• Beware of phishing emails asking for personal information. Only use the official www.usaadatasettlement.com to submit forms (settlement FAQs).
• The official site explicitly warns that it will never ask for payment or sensitive data outside the claim process.

The pattern: high-profile settlements inevitably attract scammers. The court-approved process is transparent – if someone calls or emails demanding immediate action, it’s a red flag.

How much can I get from the USAA breach?

The total fund is $3.25 million, but individual payouts will vary. After attorney fees, administration costs, and service awards for class representatives, the remaining amount is divided among class members who filed valid claims.

How is the payout amount calculated?

• Typical data breach settlements in the U.S. yield individual payments between $50 and $500 per person, but amounts can be lower if many claims are filed (Top Class Actions).
• The exact per-person amount will be announced after the claims administrator tallies all valid forms.

What is the average payout per person?

• At this stage, there is no average – the final number depends on how many of the ~22,000 affected members submitted a payment election form by the April 7, 2025 deadline (settlement FAQs).

Will payments be the same for everyone?

• Yes, the settlement appears to use a pro rata distribution model – all approved class members receive an equal share from the net fund.

What this means: if 10,000 valid claims are submitted, each person might get around $200-$300; if 22,000 claims, the amount may fall to about $100.

How to get your payout in USAA’s $3.25M data breach settlement

The official process required eligible class members to submit a Settlement Payment Election Form by April 7, 2025. That deadline has passed, but understanding the steps can still help if you are reviewing your options or need to contact the administrator.

How do I file a claim?

1. Go to www.usaadatasettlement.com and complete the online form or download a paper copy to mail (settlement FAQs).
2. No separate claim form was required – only the payment election form.
3. Provide personal information to verify your identity and match the records from the incident.
4. Submit the form by the deadline (April 7, 2025 – now passed).

What is the deadline to submit a claim?

• The deadline was April 7, 2025 (settlement FAQs).
• If you missed the deadline, you may still be able to contact the administrator for guidance, though late submissions are generally not accepted.

Do I need to provide proof of identity?

• Yes, you will need to verify your identity to ensure you are the person whose data was compromised. The form asks for personal details matching the records from the incident.

The trade-off: the window for filing was relatively short, and many eligible members may have missed it. Those who filed in time are now in the payment queue.

What happens after I file a claim?

After submitting your payment election form, the claims administrator reviews each submission to confirm eligibility. Payments are not issued immediately – the legal process must conclude.

How long does the settlement process take?

• In similar class actions, payouts typically occur 6 to 12 months after the claim deadline (Yahoo Finance).
• Since final approval was granted in May 2025, distributions could begin as early as late 2025 or early 2026.

Will I receive a confirmation?

• Yes, the administrator sends a confirmation email or letter after processing your form. Keep it for your records.

When can I expect payment?

• Payments are sent after all appeals are resolved and the court gives final approval for distribution. Check the settlement website for updates (official site).

The pattern: most data breach settlements follow a similar timeline – a few months of review, then a window for checks. Patience is key.

Timeline of the USAA data breach settlement

• May 6, 2021: Data incident occurs, exposing personal information of ~22,000 members (official settlement portal)
• 2021: Class action lawsuits filed and consolidated as In re USAA Data Security Litigation
• 2023-2024: Settlement negotiations lead to proposed $3.25 million fund
• March-April 2025: Notice sent to class members; payment election forms due by April 7 (Top Class Actions)
• May 21, 2025: Federal judge grants final approval (Bloomberg Law)
• 2026 (estimated): Distribution of payments, assuming no appeals

The key: the timeline has already passed critical milestones. If you missed the filing deadline, you are likely out of the payout pool.

Voices from the settlement

“To resolve all Released Claims against all Released Parties, USAA has agreed to pay a total of $3,250,000.00.”

— Claims administrator, official settlement website (USAA Data Incident Settlement)

“A $3.25 million class action settlement was reached in connection with the 2021 breach.”

— Security.org (identity theft and breach analysis) (Security.org)

“USAA allowed unauthorised access to personal data of 22,000 customers, when they suffered a breach attack in May 2021.”

— Reddit user r/USAA (community discussion)

For the affected USAA member, the choice is now about staying alert: guard against identity theft, keep an eye on the settlement website for payment updates, and be wary of scams. The class action process has run its course; what remains is the distribution of the $3.25 million fund. For those who filed on time, a check could arrive in the coming months. For those who missed the deadline, the lesson is painful: in class action settlements, the window to act is narrow.

Frequently asked questions