Four class-action settlements tied to Panda Express, GrubHub, Google, and Discover are paying out claims in spring 2026, and millions of Americans may be eligible without knowing it. Each case stems from a data breach or privacy violation, and the payout gap between claimants who bring documentation and those who don’t is stark: people who can prove financial losses may recover up to several thousand dollars, while those who file without receipts are looking at roughly $25 to $100.
The filing windows are limited, the scam risk is real, and the difference between a meaningful check and a token payment comes down to preparation. Here is what each settlement involves, what the public record actually confirms, and how to position yourself for the highest possible payout.
Panda Express: a confirmed breach with a clear paper trail
Panda Restaurant Group, the parent company behind more than 2,000 Panda Express locations, filed a formal data breach notification with the California Department of Justice under report number SB24-584678. Under California Civil Code § 1798.82, that filing is mandatory whenever unencrypted personal information has been accessed, or is reasonably believed to have been accessed, by an unauthorized party.
The notification is publicly searchable through the state’s OpenJustice portal. It does not specify how many individuals were affected or which categories of data were exposed, but the filing itself is a legal acknowledgment that a security failure occurred. Plaintiffs’ attorneys routinely use these state-mandated disclosures as the foundation for class-action lawsuits, and a breach affecting a chain of Panda Express’s size can pull in an exceptionally large class.
If you dined at Panda Express, used the company’s app, or placed online orders during the period covered by the breach, watch your physical mail and email for an official notice from a court-appointed claims administrator. That notice will contain the claims website URL, the filing deadline, and instructions for submitting documentation of any financial harm you experienced.
GrubHub: breach confirmed, settlement in progress
GrubHub confirmed in early 2025 that a security incident exposed customer account information, including names, email addresses, phone numbers, and partial payment card data. The breach also affected some delivery drivers’ information. Litigation followed, and a proposed settlement has been reported in connection with claims against GrubHub Holdings Inc.
The settlement follows a tiered structure: claimants who can document unauthorized charges, identity theft costs, or out-of-pocket expenses tied to the breach are eligible for higher individual payouts, while class members who file without supporting documentation receive a smaller flat payment from the common fund.
If you had a GrubHub account during the affected period, check your email (including spam folders) for a notice from the claims administrator. You can also search for the case on the federal court’s PACER system to verify the settlement’s status and terms directly from court filings.
Google: location tracking settlement distributing payments
Google’s largest active privacy settlement stems from In re Google Location History Litigation, filed in the U.S. District Court for the Northern District of California (Case No. 5:18-cv-05062). The case alleged that Google continued tracking users’ location data even after they turned off the “Location History” setting on their devices. Google agreed to a settlement, and distribution to eligible class members has been reported as ongoing in 2026.
The class potentially includes anyone who had a Google account and used an Android device or Google services with location features during the covered period. Because the class is enormous, per-person payments for claimants without documented losses are expected to be modest. Claimants who can show specific financial harm connected to the data collection practices may receive higher amounts, but the vast majority of eligible users will fall into the no-documentation tier.
The official settlement website for this case is the only reliable place to check eligibility and file. Be cautious of third-party sites that claim to check your status but ask for personal information upfront.
Discover: communication and account practice claims
Discover Financial Services has faced litigation related to unsolicited communications and certain account practices, including claims brought under the Telephone Consumer Protection Act (TCPA). TCPA cases typically allege that a company made automated calls or sent text messages without proper consent, and settlements in these cases often create a common fund divided among approved claimants.
Specific settlement terms, including the total fund size and per-claimant caps, vary by case. If you received calls or texts from Discover that you did not authorize, or if you were notified that your account information was involved in a data incident, you may be part of an eligible class. As with the other settlements, the official court notice is the definitive source for deadlines and filing instructions.
Why the gap between $100 and $5,000 matters so much
The two-tier payout structure is standard in data breach and privacy settlements, and it exists for a straightforward reason: courts want to compensate people who suffered real financial harm at a level that reflects their actual losses, while still acknowledging that the breach affected everyone in the class.
In practice, this means a claimant who submits bank statements showing $3,200 in unauthorized transactions tied to a breach may recover most or all of that amount, up to the settlement cap. A claimant who checks a box confirming class membership but provides no documentation might receive $25 to $100, depending on how many people file.
The specific dollar figures circulating online for these four settlements, including the $5,000 ceiling for documented losses and roughly $100 for no-proof claims, are consistent with how courts typically structure these distributions. However, final per-person amounts depend on three variables: the total settlement fund approved by the court, the number of valid claims filed, and the deductions for administrative costs and attorneys’ fees (which courts typically cap at 25% to 33% of the fund). Widely publicized settlements sometimes pay less per person than expected because high claim volume dilutes the fund.
How to file: step by step
The process is similar across all four settlements, but the details (deadlines, documentation requirements, claims site URLs) are case-specific. Here is what to do:
1. Locate the official claims site. Every court-approved settlement has a dedicated website run by the claims administrator. The URL is listed in the official notice you received by mail or email. Legitimate sites reference a specific court, case number, and judge. If a site lists dollar amounts without legal citations, treat it as informational only.
2. Read the settlement notice in full. The notice defines who qualifies (the “class definition”), what the filing deadline is, what documentation is accepted, and how to opt out or object. Missing a deadline by even one day can disqualify an otherwise valid claim.
3. Gather documentation before you start the form. Pull together purchase receipts from Panda Express, order history from GrubHub, account statements from Discover, breach notification letters you received, and invoices for credit monitoring or fraud resolution services you paid for after learning about a breach. Screenshots of notification emails count. The stronger your paper trail, the higher your potential payout tier.
4. File early. Submitting well before the deadline gives you time to correct errors or supply additional documentation if the claims administrator requests it. Most claims can be filed online.
5. Protect yourself from scams. Fraudulent settlement sites are common. A legitimate claims administrator will never ask for your full Social Security number on an open web form. If something feels off, call the toll-free number listed in the official court notice to verify.
Tax implications most claimants overlook
Settlement payments are generally considered taxable income by the IRS. If your payout exceeds $600, the claims administrator is required to issue a 1099 form. Payments that reimburse you for actual financial losses (like fraudulent charges you can document) may be treated differently than flat payments for general class membership. If you expect a significant payout, consult a tax professional before filing season to avoid surprises.
How to verify any settlement before you file
The volume of online chatter about these four settlements is high, and not all of it is accurate. The only reliable way to confirm whether a settlement exists, who qualifies, and what the deadlines are is to check primary sources:
- California DOJ breach notifications: The Attorney General’s data breach report list is publicly searchable and confirms whether a company filed a mandatory disclosure.
- Federal court records: The PACER system provides access to case filings, settlement agreements, and court orders for federal litigation.
- Official settlement websites: These are created by court-appointed administrators and listed in the court’s approval order. They are the only authoritative source for claim forms and deadlines.
The Panda Restaurant Group notification on the California DOJ’s portal is a clear example of how these cases begin with a verifiable public record. For GrubHub, Google, and Discover, court filings provide the same level of confirmation. File based on what you can verify through these sources, keep your records organized, and do not leave money unclaimed because you skipped the documentation step.
