Allstate Data Breach Lawsuit Investigation
Received an August 2026 breach notice from Allstate?
Dapeer Law, P.A. is investigating a potential class action against The Allstate Corporation, one of the largest personal insurance carriers in the United States, on behalf of individuals whose personal information may have been exposed in the June 2026 cyber incident disclosed to state regulators in August 2026.
Who may qualify
You may be eligible to participate in a class action if any of the following applies:
- You received a data breach notification letter from Allstate dated August 2026.
- Your letter offered enrollment in 24 months of free Allstate Identity Protection, Essentials plan coverage, serviced by InfoArmor, Inc.
- You had personal or financial information held by Allstate in its capacity as an insurance carrier, or provided it during an Allstate appointment or application process.
- No proof of harm required to consult with counsel. You do not need to have already suffered identity theft to explore your legal options.
- Excluded: individuals who did not receive a breach notice and whose information was not involved in the incident.
Not sure if you qualify?
Send us your notice, we'll confirm your eligibility at no cost.
What happened
According to the breach notice filed with the Massachusetts Attorney General, Allstate learned on July 26, 2026 that customer information "may have been taken without authorization." Allstate says it worked to validate the claim and determined that data was acquired on June 19, 2026. The company states it began a thorough investigation, engaged independent cybersecurity experts, and reported the incident to law enforcement. The cause of the incident is not described in the consumer notice.
Allstate says it confirmed on August 7, 2026 which individuals were affected, and began mailing notice letters on August 14, 2026. The letters state that a recipient's full name and Social Security number may have been affected. State regulator filings reviewed for this page report a total of 381 affected individuals, 377 in Texas and 4 in Massachusetts, and indicate the information involved may also include address, date of birth, and other appointment-related details. Because the public notice does not itemize the data for every state, notice recipients should check their individual letter for the categories that apply to them.
Social Security numbers are among the most damaging categories of data to lose, because they cannot be changed and can be used for years to open credit accounts, file fraudulent tax returns, or claim government benefits. Where insurance application and appointment records are involved, the same file set can also contain dates of birth and address history, which together with a Social Security number is enough to complete most identity verification checks. Dapeer Law is evaluating whether Allstate's data security practices and the timing of its notice give rise to claims for the people who received letters.
What to do if you received a letter
Keep your notice letter
Do not discard it. Your letter contains the enrollment code for the identity protection services and is important evidence if you decide to participate in a lawsuit.
Enroll in the free 24-month identity protection
Enroll in the Allstate Identity Protection, Essentials plan offered in your letter. The notice states you have 90 days from the date of the letter to activate the coverage, which includes credit monitoring across Equifax, Experian, and TransUnion, fraud alerts, credit freeze assistance, dark web monitoring, identity theft remediation support, and up to $1,000,000 in fraud-related expense coverage. Accepting this benefit does not waive your right to pursue legal action.
Place a fraud alert or credit freeze
Contact Equifax, Experian, and TransUnion to place a fraud alert or freeze on your file. Request a free weekly credit report from AnnualCreditReport.com, and use the FTC's IdentityTheft.gov recovery guide. Because Social Security numbers were involved, also watch for unfamiliar tax filings, new credit accounts you did not open, and government benefit notices you did not apply for.
Speak with a data breach attorney
Consultations with Dapeer Law are free and confidential. We'll review your notice, explain your options, and advise whether you may be eligible to join a class action.
Submit your notice for a free review
Two minutes online. A licensed attorney reviews every submission.
Breach timeline
Compensation you may be entitled to
Out-of-pocket expenses
Credit freezes, identity restoration services, and other costs incurred responding to the breach.
Time spent monitoring
Hours spent reviewing accounts, disputing fraudulent charges, and dealing with identity theft issues.
Identity theft & fraud losses
Unreimbursed funds stolen from accounts, unauthorized credit lines, tax refund fraud, or tax refund fraud tied to the breach.
Statutory damages
Certain state data breach and consumer protection statutes provide for fixed damages regardless of actual loss.
Injunctive relief
Court orders requiring Allstate to implement stronger data security practices going forward, including better safeguards for the Social Security numbers and application records it collects and retains.
Compensation categories depend on applicable state law, the types of data exposed, and documented losses. No recovery is guaranteed.
Common questions
I received a data breach letter from Allstate. What should I do? +
Keep your letter, including the enrollment code, and activate the free Allstate Identity Protection, Essentials plan within 90 days of the letter date. Review your account statements and free credit reports for activity you do not recognize, and consider placing a fraud alert or a security freeze with Equifax, Experian, and TransUnion. Because Social Security numbers were involved, also watch for tax filings or credit accounts opened in your name. A data breach attorney can review the letter with you at no cost and explain what claims may be available.
Am I eligible to join a class action against Allstate? +
If you received a notice letter from Allstate about this incident, you are likely within the group being evaluated. Eligibility for a class action can depend on your state of residence, the categories of information involved in your particular letter, and whether you have experienced fraud, identity theft, or out-of-pocket costs since the breach. Documented losses generally strengthen an individual claim, but they are not always required to participate.
How much money could I receive from a class action lawsuit? +
Data breach class action recoveries vary significantly. Settlements typically range from a few hundred dollars for basic out-of-pocket losses to several thousand dollars for documented identity theft, with class size, damages, and negotiation all affecting the final amount. No payout is guaranteed, and this investigation has not yet resulted in a settlement.
What personal information was exposed in the breach? +
The consumer notice states that a recipient's full name and Social Security number may have been affected. State regulator filings reviewed for this page indicate the information involved may also include address, date of birth, and other appointment-related details. Allstate has not published a complete category list for every affected state, so check your individual letter for the specific information that applies to you.
Did Allstate offer free credit monitoring? +
Yes. Allstate is offering 24 months of its Allstate Identity Protection, Essentials plan at no cost, serviced by InfoArmor, Inc. The plan includes credit monitoring across Equifax, Experian, and TransUnion, rapid fraud alerts, credit freeze assistance, dark web and digital identity monitoring, full-service identity theft remediation, and up to $1,000,000 in fraud-related expense coverage. The notice states you must enroll within 90 days from the date of the letter. Enrolling does not waive your right to pursue legal action.
How many people were affected by the Allstate breach? +
State regulator filings reviewed for this page report 377 affected individuals in Texas and 4 in Massachusetts, for a total of 381 people. Allstate has not published a nationwide figure, and filings in other states could raise the total. This page will be updated as more information becomes available.
Is there a deadline to take legal action? +
Yes. Statutes of limitations for data breach claims vary by state and legal theory, typically ranging from one to six years. Waiting can permanently bar your claim. Contact us as soon as possible for a free evaluation.
How do I get a copy of the official breach notice? +
Allstate's notice was filed with state regulators, including the Massachusetts Attorney General, whose office publishes the letter as a PDF. You can download it from the button near the top of this page or from the link in the Sources and references section. If you cannot locate your own letter, Dapeer Law can help you request a copy during a free consultation.
Sources & references
- Official breach notice filing · Massachusetts Attorney General, Allstate data breach notice (PDF)
- Company · The Allstate Corporation (allstate.com)
- Credit bureau freezes · Equifax · Experian · TransUnion
- Free weekly credit reports · AnnualCreditReport.com
- Identity theft recovery guide · FTC IdentityTheft.gov
Don't let the deadline decide for you. Submit your claim today.
You only have a limited window to act. Our team will review your notice, explain your options, and tell you whether you may be eligible to recover compensation, at no cost to you.
