The administrator overseeing Cash App’s $15 million data breach settlement confirmed on September 28, 2026, that payments to approved claimants would go out during October, according to OpenClassActions. For the roughly 40,380 Cash App users whose claims survived a two-year review process, the payments landing in Venmo balances, Zelle transfers, prepaid cards and paper checks this month close out a saga that started with an insider breach back in December 2021.
The timing matters beyond the individual payouts. Block Inc., the parent company of Cash App, is simultaneously working through a separate $45 million multistate settlement with state attorneys general over how it marketed fraud protection to users, a deal Pennsylvania Attorney General Dave Sunday announced earlier in 2026. Two settlements, two different legal theories, one payments company facing sustained scrutiny over how it handles both data security and fraud on its platform.
What the $15 million settlement actually covers
The case, Salinas v. Block, consolidated claims from Cash App users who said their personal information or account details were exposed, or who suffered fraudulent withdrawals and transfers, between August 23, 2018, and August 20, 2024. The underlying incident traces back to April 2022, when Block disclosed that a former employee had accessed internal reports containing customer names and brokerage account numbers after leaving the company. In an SEC filing cited by TechCrunch, Block said the employee “had regular access to these reports as part of their past job responsibilities,” but “in this instance these reports were accessed without permission after their employment ended.” Roughly 8.2 million current and former customers were notified.
Two Cash App users, Michelle Salinas and Raymel Washington, sued Block in 2022 over what their complaint called negligent security practices, a case Forbes reported at the time covered allegations tied to that 8.2 million-user exposure. The litigation later folded in claims about a second 2023 security incident. Block never admitted wrongdoing. It agreed to the $15 million fund anyway, a familiar pattern for the cybersecurity threats era: settle, pay out a fraction of the headline number to people who can document real losses, and move on.
The October 2026 payment math, broken down
A federal court granted final approval to the settlement on March 27, 2025. Electronic payments to the first wave of approved claimants began April 10, 2025, with paper checks mailed starting April 20, 2025. The October 2026 round is effectively settlement cleanup: a second distribution covering money left over from the first round, undeliverable checks, and returned electronic payments, per OpenClassActions’ tracking of the case docket. Distribution under the current order runs through December 7, 2026.
Here is the scale problem that explains why individual checks are so small relative to the $15 million headline: more than 667,000 claim forms were filed before the November 18, 2024 deadline, but only about 40,380 were approved, totaling roughly $5.6 million distributed against the full fund. That is a claim approval rate of roughly 6%, driven by the settlement’s documentation requirement — claimants had to produce third-party proof of a “data security incident, unauthorized account event, or deficiency in error resolution,” not just a general sense that something went wrong with their account.
| Metric | Figure | Source |
|---|---|---|
| Total settlement fund | $15 million | Court filing, Salinas v. Block |
| Claim forms filed | 667,000+ | OpenClassActions case tracker |
| Claims approved | ~40,380 | OpenClassActions case tracker |
| Total paid out so far | ~$5.6 million | OpenClassActions case tracker |
| Final court approval date | March 27, 2025 | Court docket |
| First payments issued | April 10-20, 2025 | Settlement administrator |
| Second distribution window | October-December 7, 2026 | Settlement administrator, Sept. 28, 2026 notice |
| Max out-of-pocket reimbursement | $2,500 per claimant | Settlement terms |
| Max lost-time compensation | $75 (3 hrs at $25/hr) | Settlement terms |
| Average reported payment | ~$200 | OpenClassActions case tracker |
Who actually qualifies, and who already missed the window
The claims deadline closed on November 18, 2024, and the settlement administrator is not accepting new applications of any kind. If a Cash App user is just now hearing about the $15 million fund because October’s distribution is generating headlines, they are too late to file a new claim. The only people receiving money this month are the roughly 40,380 who already went through the approval process. That gap between “settlement in the news” and “settlement open for new claims” is a recurring source of confusion around every data breach payout, and it is worth stating plainly: there is no live, unexpired claim window for Cash App users to file into in October 2026.
Approved claimants are being paid through four channels: direct Venmo deposits labeled from the “Cash App Security Settlement Administrator,” Zelle transfers, prepaid debit cards, and mailed paper checks. Reported individual amounts range from under $100 up to roughly $2,500 for people who documented the maximum qualifying out-of-pocket losses, such as credit freeze costs, replacement card fees, or unrefunded overdraft charges tied directly to the breach.
A second, separate settlement complicates the picture
Running in parallel to the data breach payout is a $45 million multistate settlement that Pennsylvania Attorney General Dave Sunday’s office announced in 2026, resolving a different set of allegations: that Block misled Cash App users about the strength of its fraud protections while internally aware that fraud on the platform was climbing. Pennsylvania’s own cut of that fund came to $1,137,695.72, earmarked for consumer protection and education programs, according to the state attorney general’s office. As part of that deal, Block agreed to maintain live phone support for at least 13.5 hours a day and to expand direct fraud education for users going forward.
It is easy to conflate the two settlements because they involve the same company and overlapping harm — fraud and account security on Cash App — but they are legally distinct. The $15 million fund resolves a private class action over a specific 2021-2023 data exposure. The $45 million fund resolves a regulatory enforcement action over marketing and service practices. Readers tracking “the Cash App settlement” in October 2026 are really watching two separate legal tracks that happen to be converging in the news cycle at the same time.
| Settlement | Amount | Legal basis | Who’s paid |
|---|---|---|---|
| Salinas v. Block (data breach) | $15 million | Negligent security, private class action | ~40,380 approved Cash App users |
| Multistate AG settlement | $45 million | Deceptive marketing of fraud protections | State governments (consumer protection funds) |
Historical context: this is Block’s second major Cash App reckoning
Block has now faced multiple rounds of litigation tied to Cash App security since the 2021 insider breach first surfaced. A separate shareholder lawsuit over the same 2021 incident was defeated in court in 2025, according to Reuters reporting picked up by TradingView, suggesting Block has had mixed legal outcomes depending on who is suing and under what theory — shareholders claiming financial harm to the company fared worse than customers claiming direct personal harm. That split outcome is a useful data point for anyone tracking how large-scale data exposure cases typically resolve: consumer class actions tend to settle for real money, shareholder derivative suits tend to get dismissed.
Cash App’s breach history also sits inside a broader pattern of fintech and payments apps absorbing insider-access incidents rather than purely external hacks. Unlike a classic credential-stuffing attack or a ransomware intrusion, the 2021 Cash App breach involved someone who already had legitimate system access and simply kept using it after their employment ended — a failure of offboarding and access revocation, not of perimeter defense. That distinction shows up again and again in breach postmortems, and it is a reminder that companies tracking vendor and insider risk need controls that extend past the moment someone leaves a job.
Market and reputational impact for Block
Fifteen million dollars is immaterial on Block’s balance sheet relative to its overall revenue base, and the market has treated both settlements as routine cost-of-doing-business line items rather than existential news. The bigger exposure for Block is reputational and regulatory: a second settlement in the same year focused specifically on fraud-protection marketing claims signals that state regulators are watching how peer-to-peer payment apps describe their safety features to consumers, not just how they store data. For a platform whose entire value proposition rests on instant, trusted money movement, repeated settlements over fraud handling chip away at the “your money is safe here” pitch more than a single breach disclosure would.
That dynamic also plays out against a fraud-detection industry that has grown specifically to plug these gaps for platforms that move money peer-to-peer. Vendors in the space — the kind compared in pieces like Kount vs Sift vs Forter — exist precisely because in-house fraud controls at consumer fintech apps have repeatedly proven insufficient at the scale Cash App operates. Cyber insurance underwriters, covered in comparisons such as Coalition vs Chubb vs At-Bay, now factor exactly this kind of multistate exposure into premium pricing for large fintech clients.
Competitive comparison: how Cash App’s breach response stacks up
Measured against other 2026 breach settlements covered on this site, Cash App’s payout sits in a middle tier. It is far larger in total claim volume than the ASOS breach, which involved a single compromised employee account and no confirmed ICO filing as of this year, but its $15 million fund is a fraction of what hit Oracle Health, where nearly 20 million people had data exposed. What sets the Cash App case apart is the insider-access vector combined with the sheer number of people who filed claims: 667,000-plus filings is an enormous administrative load for a settlement fund this size, and it is a big part of why the approval rate landed near 6% rather than the much higher approval rates seen in simpler, single-vector breaches.
Compare that to enterprise breach responses where companies like the ones behind automated KYC and compliance document intake have pushed verification into software specifically to cut down on exactly the kind of manual, error-prone claims review that stretched the Cash App settlement’s timeline out to more than two years from incident to final payout.
What this means for Cash App users right now
For the 40,380 approved claimants, the practical advice is simple: check the payment method on file with the settlement administrator, watch for a Venmo deposit specifically labeled from the “Cash App Security Settlement Administrator,” and keep any paper checks until they clear, since the second distribution is scheduled to run through December 7, 2026 and not every payment will land on the same day. For everyone else, the clearest signal to watch for is fraud: any message claiming a new claim window is open, or asking for banking details to “verify” settlement eligibility, is not legitimate. The real settlement site, cashappsecuritysettlement.com, does not require banking credentials to confirm status on an already-filed claim.
Predictions: where this goes from here
- Expect the October-December 2026 distribution window to close with a portion of the $15 million fund still undistributed, given the pattern of undeliverable checks and returned electronic payments already seen in round one; any leftover balance is likely to flow to cy pres recipients rather than back to claimants.
- Expect at least one more state attorney general to join or reference the $45 million multistate fraud-marketing settlement before year-end, following Pennsylvania’s lead, as state regulators continue coordinated scrutiny of peer-to-peer payment apps.
- Expect Block to continue framing both settlements as resolved, legacy matters in investor communications, since neither involves an admission of liability and neither amount is large enough to move guidance.
- Expect renewed scrutiny of insider-access controls across fintech platforms broadly, as the Cash App case remains one of the clearest examples of a former employee’s un-revoked access causing a multi-year legal and financial tail.
- Expect fraud-detection and identity-verification vendors serving consumer fintech to cite this settlement in sales conversations as justification for tighter, automated offboarding and access-review tooling.
Why the documentation requirement mattered so much
The approval rate is the most revealing number in this entire story. A roughly 6% approval rate out of more than 667,000 filed claims is not evidence that most filers were trying to defraud the fund; it reflects how high the evidentiary bar was set. Claimants needed third-party documentation tying their losses directly to a security incident, an unauthorized account event, or a dispute-resolution failure — bank statements, fraud case numbers, or written denials from Cash App’s own support team, not just a personal recollection that something felt wrong with an account years earlier. That bar is standard for data breach settlements generally, but it means headline fund sizes like “$15 million” or “$45 million” routinely overstate what any single affected person is likely to actually receive.
The bigger pattern: fintech breach settlements are getting more frequent, not less
Cash App’s situation does not exist in isolation. Payment platforms, banks, and consumer finance apps have faced a steady cadence of breach and fraud-related settlements through 2025 and 2026, a trend consistent with broader reporting on rising data theft incidents across sectors that handle sensitive financial and personal information. What distinguishes the fintech cases specifically is the dual exposure: these companies face both classic data-security litigation when records are exposed, and separate consumer-protection litigation when their fraud-prevention marketing does not match reality. Cash App is now a case study in both failure modes landing on the same company within a few years of each other.
Frequently Asked Questions
Is the Cash App $15 million settlement claim window still open?
No. The deadline to file a claim form was November 18, 2024, and the settlement administrator stopped accepting new applications after that date. Only previously approved claimants are being paid in the October 2026 distribution.
How much money will approved claimants receive?
Payments vary based on documented losses, with a cap of $2,500 for out-of-pocket expenses and up to $75 for lost time. Reported amounts have ranged from under $100 to the $2,500 maximum, with an average closer to $200.
What caused the original Cash App data breach?
A former Block employee accessed internal reports containing customer names and brokerage account numbers after their employment had ended, a breach Block disclosed in April 2022 affecting about 8.2 million current and former customers.
Is this the same as the $45 million Cash App settlement?
No. The $45 million deal is a separate multistate settlement with state attorneys general over how Block marketed fraud protections, while the $15 million fund resolves private claims tied specifically to the 2021-2023 data exposure incidents.
How will payments arrive?
Approved claimants are being paid via Venmo deposits labeled from the “Cash App Security Settlement Administrator,” Zelle transfers, prepaid debit cards, or mailed paper checks, depending on the payment method selected or on file.
What should I do if I get a message about a “new” Cash App settlement claim?
Treat it as a likely scam. The legitimate claims window closed in November 2024, and the official settlement site does not ask for banking passwords or verification codes to process an already-filed claim.
Why did so few claims get approved out of 667,000 filed?
The settlement required third-party documentation proving a direct financial loss or account issue tied to the breach, a bar that only about 40,380 of the filed claims cleared.
Does this settlement mean Block admitted wrongdoing?
No. Block and Cash App have disputed the underlying allegations in both the data breach case and the multistate fraud-marketing settlement, and agreed to pay without admitting liability.
