In late 2024, some people submitted their Cash App settlement claim, but they later forgot about it. It makes sense. Waiting for a check for two years is a long time. However, eligible users are beginning to receive payments this month, and some are probably squinting at a deposit notice, trying to recall what it was for.
The money’s backstory begins in December 2021. After leaving the company, a former employee of Cash App downloaded reports that contained customer data. While they were employed there, the access had been authorized. It just never turned off. The parent company of Cash App, Block, did not reveal this to the public until it submitted a disclosure to the SEC in April 2022. In the ensuing litigation, that more than four-month lapse turned into a sore spot.
| Detail | Information |
|---|---|
| Case name | Salinas v. Block, Inc. and Cash App Investing, LLC |
| Court | U.S. District Court, Northern District of California |
| Defendants | Block, Inc. and Cash App Investing, LLC |
| Settlement amount | $15 million |
| Admission of wrongdoing | None; both companies deny the allegations |
| First incident | December 2021: a former employee downloaded customer reports |
| Public disclosure of first incident | April 4, 2022, through an SEC filing |
| Customers notified about the first incident | About 8.2 million current and former U.S. Cash App Investing users |
| Data exposed in 2021 | Full names, brokerage account numbers; for some, portfolio value, holdings and one day of trading activity |
| Data not exposed in 2021 | Passwords, Social Security numbers, bank account details, payment card data, addresses, dates of birth |
| Second incident | 2023: unauthorized logins through recycled phone numbers |
| Claims covered | Negligence, misrepresentation, slow handling of complaints about unauthorized withdrawals |
| Covered period | August 23, 2018 to August 20, 2024 |
| Maximum payout | Up to $2,500 per claimant |
| Lost time compensation | Up to 3 hours at $25 per hour |
| Claim deadline | November 18, 2024 (closed) |
| Final approval | March 27, 2025 |
| Payment timing | October 2026 |
| Who gets paid | Only people who filed a valid claim before the deadline |
| Comparison | AT&T data breach settlement: $177 million |
| Protective steps | Update phone and email, enable Security Lock, turn on transaction alerts, watch for phishing |
Approximately 8.2 million current and former Cash App Investing users in the US were covered by the reports. Full names, brokerage account numbers, and, for some, portfolio values, holdings, and a single trading day were all included. Block claimed that the files lacked Social Security numbers, passwords, addresses, and bank account information. That is important. It’s also not the same as claiming that nothing was lost.
In 2023, a second, more peculiar issue emerged. Traditional passwords are not used by Cash App. A verification code is sent to an email address or phone number. A stranger may end up with a number that still unlocks someone else’s account because carriers recycle old numbers. Imagine a brand-new phone beeping with a login code intended for a stranger. As a result, some customers reportedly witnessed fraudulent transactions.
In federal court in Northern California, the subsequent lawsuits were combined into one case, Salinas v. Block. The companies, according to the plaintiffs, were careless, misrepresented their protections, and took a long time to address complaints regarding unapproved withdrawals. Block and Cash App Investing denied any misconduct. In any case, they consented to a $15 million settlement—a pattern so prevalent in data breach cases that it’s easy to overlook.
The words are precise. Up to $2,500 could be awarded to claimants for documented out-of-pocket losses during the time frame of August 23, 2018, to August 20, 2024. At $25 per hour, lost time is also taken into account up to three hours. The November 18, 2024, claim deadline has long since passed. According to the terms of the settlement, those who did not file are out of luck.
Is fifteen million dollars a lot? Depending on the yardstick, yes. It appears thin when spread across millions of impacted customers. Even though there were many more parties involved in that case, AT&T’s data breach settlement came to $177 million. These figures don’t seem to reflect how uncomfortable people are when they discover a company has lost their data.
The practical issue of what a payout actually covers comes next. The majority of claimants won’t receive nearly $2,500. The number is moved by documented losses, and the cap is a ceiling rather than a promise. The sum might seem more symbolic than practical to someone whose name and account number were compromised but who did not lose any money.
Even so, it’s difficult to ignore how little of this was dramatic. No firewall breach, no hooded hacker. One poorly managed departure and one peculiarity in the way the app authenticates users. Really dull failures. Additionally, dull failures are typically the ones that recur.
The sensible actions are insignificant for anyone getting paid. Change the account’s email address and phone number. Activate transaction alerts and Security Lock. Unexpected texts regarding Cash App should be treated suspiciously because a convincing scam message requires a leaked name and account number. It remains to be seen if Block’s promised security enhancements will materialize; only time will tell.
