Data Breach Lawsuits Took A $155M Toll On Businesses In Less Than A Year: Report

Some industries are getting sued more than others in data breach lawsuits.

Cyber breaches can be costly for companies. A new report from Panaseer, provider of cybersecurity posture management solutions, found that U.S. organizations have shelled out nearly $155 million for class-action lawsuits related to data breaches between August 2024 and February 2025.

The report’s data was based on data breach class-action filings from ClassActions.org and on settlement information from the Top Class Actions website, Panaseer said in a news release.

Some takeaways from the report:

• Data breach class-action settlements typically average $3 million, with the largest settlement at $21 million.
• Payouts to individuals—employees or customers affected by a breach--ranged from $150 to $12,000, according to the report.
• The most common security lapse leading to class-action lawsuits was “inadequate security measures,” the report read.
• -Failing to encrypt data, and delayed security breach notifications were the second- and third-most reasons that brought about data breach lawsuits.
• The healthcare, financial, and retail sectors face the most lawsuits and pay the highest fines, according to the report

Data breach court cases reached “unprecedented levels” in 2024, Panaseer’s report said.

“While people – and the courts – can be understanding when a company falls victim to an attack, they’re far less forgiving when it looks like the organization failed in its duty of care around data,” Jonathan Gill, CEO at Panaseer, said in a news release. “But most breaches don’t happen because companies willfully ignore security. Instead, they will set a target risk position, then over time slide back and take on more exposure than intended because well-intentioned people don’t have information they can trust, presented in a language they understand, to do the important work. It’s a process problem, not a people problem,” he added.