Top 7 Data Breach Fines, Penalties, and Settlements to Date

As data breaches become more frequent and severe, companies must prioritize their data security measures to avoid facing substantial fines and penalties. In fact, according to the Ponemon Institute, the projected average cost of a data breach is set to reach approximately $5 million in 2023. This marks an increase from $4.35 million in 2022 and $4.24 million in 2021.

Data breaches often result in severe consequences such as penalties and fines.

Here are the top 7 Data Breach Fines, Penalties, and Settlements to Date

Didi Global- July 2021

Didi Global, the major ride-hailing company in China, was fined $1.2 billion by the Chinese government for violating data privacy laws in a data breach lawsuit.

The company was charged with gathering and utilizing personal data without authorization and failing to safeguard user data from cyberattacks. The data breach occurred in May and June of 2021, when Didi’s databases were compromised, resulting in the exposure of the personal information of millions of users, such as their names, phone numbers, and addresses.

Facebook – July 2019

Failing to protect user data and engaging in deceptive practices has cost Facebook a $725 million fine by the Federal Trade Commission (FTC).

During the Cambridge Analytica, a political consulting firm, data breach, Facebook was accused of failing to adequately protect user data and failing to disclose to users how their data was being used. Additionally, the social network was accused of engaging in deceptive practices by misleading users about the amount of control.

Amazon – 2023

Amazon was fined $886 million by the Luxembourg National Commission for Data Protection. This penalty was due to a compliance breach violation of the EU’s General Data Protection Regulation (GDPR).

The multinational technology company was accused of processing personal data in violation of GDPR, specifically in terms of its targeted advertising practices. The company was displaying targeted ads, based on users online activities, including searches and purchases, without users’ consent.

Equifax – 2019

Equifax was fined $700 million by the Federal Trade Commission for failing to protect user data.

Back in 2017, Equifax’s databases were hacked, exposing the personal information of over 143 million Americans. The American multinational company was accused of failing to implement adequate data security measures, such as failure to patch a known vulnerability in its systems.

Epic Games – 2019

Epic Games was fined $520 million by the Federal Trade Commission for violating the Children’s Online Privacy Protection Act (COPPA).

The company was accused of collecting personal information, including names and email addresses, from minors without obtaining parental consent. The FTC also reported that Epic Games failed to protect the personal information of its users, which resulted in a data breach in 2018.

T-Mobile – 2021

Following a data breach that compromised the personal information of over 50 million customers, T-Mobile faced a lawsuit seeking a data breach settlement for damages of over $500 million.

The data breach happened when hackers gained access to T-Mobile’s servers, exposing personal data such as names, phone numbers and Social Security numbers. The company was accused of failing to adequately protect user data and respond to the breach in on time.

Google – 2019

Google was fined $170 million by the Federal Trade Commission (FTC) for violating the Children’s Online Privacy Protection Act (COPPA).

The company was accused of using personal information collected from children without parental consent on its YouTube platform, to serve targeted advertisements.