Contra Costa County Data Breach Class Action Settlement

Consumers who received a data breach notice from the County of Contra Costa in May 2023 may be eligible to claim up to $5,500 and two years of credit monitoring from a class action settlement.

The County of Contra Costa agreed to resolve a class action lawsuit alleging it failed to adequately protect personal information during a September 2022 email phishing incident. The lawsuit claimed unauthorized parties may have accessed emails and attachments in two county employee accounts.

Who can file a claim?

Class members must meet the following criteria:

• They had a California mailing address.
• They received a data breach notification letter from the County of Contra Costa on or about May 10, 2023.

The settlement impacts approximately 15,591 individuals.

How much can class members get?

• Ordinary out-of-pocket expenses: Up to $500 per person for documented expenses related to the data incident. This includes costs such as credit reports, credit freeze fees, card replacement fees, late fees, overlimit fees, interest on payday loans, other bank or credit card fees, postage, mileage, gasoline for local travel and costs associated with credit monitoring or identity theft insurance purchased as a result of the incident.
• Lost time: Compensation for time spent dealing with the data incident at $25 per hour for up to four hours (maximum $100). This can be combined with ordinary expenses, but the total cannot exceed $500.

• Extraordinary expenses: Up to $5,000 per person for documented, unreimbursed extraordinary monetary out-of-pocket expenses resulting from actual identity theft or fraud related to the data incident. This includes professional fees, unreimbursed bank or card fees, overdraft fees, charges related to unavailability of funds and interest on payday loans due to card cancellations or over-limit situations.
• Credit monitoring: Two years of three-bureau credit monitoring services provided by Equifax through EAG Gulf Coast LLC regardless of whether the class member previously enrolled in credit monitoring offered by the county.

How to claim a settlement payment

Class members can submit the online claim form or download, print and complete the PDF claim form and mail it to the settlement administrator. The claim deadline is Jan. 20, 2026.

Settlement administrator's mailing address: Contra Costa Data Incident Claims Administrator, PO Box 3353, Baton Rouge, LA 70821

The claims administrator may contact claimants for additional information. Failure to provide this information may result in claim denial.

What proof or documentation required to submit a claim?

• All claimants must provide the settlement claim ID located on their settlement notice.
• For ordinary expense claims, class members must provide receipts, statements or invoices showing the amounts paid and their connection to the data incident.
• For lost time claims, class members must provide a narrative explaining the activities they performed and how they were related to the data incident. They must also attest that they spent the time dealing with the incident.
• For extraordinary expense claims, class members must provide documentation of the loss, proof of identity theft or fraud and an attestation that other sources did not reimburse the loss and they made reasonable efforts to recover the loss.

Settlement fund breakdown

The settlement fund covers:

• Settlement administration costs: To be determined
• Attorneys’ fees, costs and expenses: Up to $150,000
• Service award to class representative: Up to $2,500
• Credit monitoring costs: Determined by number of valid claims
• Payments to eligible class members: The remainder of the fund

If the total amount class members claim exceeds the available funds, the settlement administrator may reduce payments on a pro rata basis.

Important dates

• Deadline to request exclusion: Dec. 22, 2025
• Deadline to file a claim: Jan. 20, 2026
• Final fairness hearing: Feb. 5, 2026

When is the Contra Costa data breach settlement payout date?

The settlement administrator will distribute payments after the court grants final approval of the settlement and resolves any appeals.

Why did this class action settlement happen?

The class action lawsuit alleged a data incident identified on Sept. 20, 2022, involved unauthorized access to two County of Contra Costa employee email accounts. The plaintiff claimed the county failed to adequately protect personal information.

The county denies any wrongdoing or liability but agreed to settle to avoid the cost and risk of litigation.

Sources

1. Class notice
2. Claim form
3. Settlement agreement
4. Settlement FAQ