$190 Million Capital One Settlement for 98 Million Customers Whose Data Was Stolen in the 2019 Hack
Won by Morgan & Morgan.
Morgan & Morgan's John Yanchunis served as court-appointed co-lead counsel in the multidistrict litigation over Capital One's 2019 data breach, which exposed the personal information of roughly 98 million U.S. customers. The $190 million settlement won final approval in 2022 as one of the largest data breach recoveries in U.S. history.
What happened
In July 2019, Capital One disclosed that a former cloud-services engineer had exploited a misconfigured firewall to reach data the bank stored on rented servers, credit applications going back to 2005, containing names, addresses, credit scores, Social Security numbers, and linked bank account numbers. Roughly 100 million people in the United States were affected. Unlike breaches blamed on foreign intelligence services, this one traced to a single hacker and a configuration error, which made the question of corporate negligence unusually pointed.
Dozens of class actions were consolidated into a multidistrict litigation before the Eastern District of Virginia, the famously fast 'rocket docket' sitting a few miles from Capital One's McLean headquarters. The court appointed a small leadership group to run the plaintiffs' case, naming John Yanchunis of Morgan & Morgan's complex litigation group co-lead class counsel alongside Norman Siegel and Karen Hanson Riebel, a direct product of the credibility Yanchunis had built leading the Yahoo breach litigation.
The case was litigated hard rather than settled early. The plaintiffs survived dismissal motions, won contested discovery fights, including a notable ruling forcing Capital One to turn over its internal forensic incident report, and pushed the case to the brink of class certification briefing before the bank came to terms. That pressure showed in the result: a $190 million cash fund, agreed in late 2021, on top of the $80 million penalty banking regulators had separately imposed on Capital One for the same security failures.
Judge Anthony Trenga granted final approval in September 2022. The fund reimbursed out-of-pocket fraud losses and lost time for a class of about 98 million people and paid for years of identity-defense and restoration services, the kind of concrete, non-reversionary relief that had become Yanchunis's signature demand since Yahoo. Bloomberg Law reported the court's fee award to class counsel at $53.2 million, a figure the court found proportionate to a recovery it ranked among the largest ever in a data breach case.
Capital One slotted in behind Equifax and alongside T-Mobile in the top tier of American data breach settlements, and it confirmed that the playbook Morgan & Morgan's privacy team ran was repeatable: consolidate, litigate to the courthouse steps, and price the loss of 98 million people's data in nine figures.
Sources
This account is drawn from contemporaneous public reporting and the court record.
More proven verdicts from Morgan & Morgan
All Morgan & Morgan proven verdicts →A jury found the owners of the Park Social bar liable for a 2017 staircase fall that left a 57-year-old patron a partial quadriplegic, returning a $644,751,855 premises-liability verdict that the defendants have appealed to Florida's Sixth District Court of Appeal.
A federal jury in San Francisco found Google liable for invasion of privacy and intrusion upon seclusion after the company kept collecting data from third-party apps for users who had switched off the Web & App Activity setting. On September 3, 2025, the jury awarded $425,651,947 in compensatory damages and declined to award punitive damages. The award is a single class-wide figure shared by two nationwide classes of about 98 million users, not one person's recovery. The judge refused to set the verdict aside in August 2026, and Google has appealed to the Ninth Circuit.
Hours before opening arguments in the first federal opioid bellwether trial, Cuyahoga and Summit counties in Ohio secured a $260 million settlement from distributors AmerisourceBergen, Cardinal Health, and McKesson, plus manufacturer Teva.
A 2002 Dodge Ram 15-passenger van carrying 16 women from the We Are Living Proof sober-living program rolled over and caught fire on I-85 at the I-985 split in Gwinnett County on April 24, 2021, killing seven and injuring nine others. Families and survivors sued the van's driver, Chrysler and parent company Stellantis, the group home, and two repair shops, alleging a rollover-prone design, a defective steering system, and a fuel system that let gasoline ignite after impact. The claims settled in 2024 for a combined $162,000,000, described as the largest settlement from a single-vehicle wreck in Georgia history. Families and survivors were represented by several firms, including Shiver Hamilton Campbell and Beasley Allen.
Related class action verdicts
John Eddie Williams, Jr. served as one of five private attorneys retained by the State of Texas to sue the major tobacco companies, producing a $15.3 billion settlement in January 1998, the largest single-case settlement in U.S. history at the time.
As court-appointed co-lead plaintiffs' counsel in AFFF MDL 2873, Paul J. Napoli of Napoli Shkolnik negotiated a settlement requiring 3M Company to pay up to $12.5 billion to public water systems contaminated by PFAS compounds in firefighting foam, the largest drinking-water settlement in American legal history.
As court-appointed co-lead counsel in AFFF MDL 2873, Paul J. Napoli of Napoli Shkolnik helped negotiate a $1.185 billion class settlement with DuPont, Chemours, and Corteva to compensate public water systems across the United States for PFAS contamination tied to firefighting foam.