Of roughly 15,000 people mailed a notice about the Contra Costa County email phishing breach, 512 filed a claim — and 477 of those were valid by the administrator’s count six days before the deadline. The court has now approved the settlement and entered judgment, so those claimants are the only people who will receive anything. What remains is paying their claims and activating credit monitoring, with a compliance hearing on the court calendar for February 24, 2027.
Status: Final approval granted; judgment entered February 24, 2026 | Claim deadline January 20, 2026 (passed) | Compliance hearing February 24, 2027 | Per-person caps up to $5,000, plus two years of monitoring
The Claim Numbers
The settlement administrator, EAG Gulf Coast, LLC, filed a declaration on January 15, 2026 describing how notice went out and what came back. It mailed postcard notices to 15,014 class members and reported reaching 94.13% of them. By January 14, 2026, it had received 512 claims, of which 477 were valid.
| Postcard notices mailed | 15,014 |
| Reported notice reach | 94.13% |
| Claims received (as of January 14, 2026) | 512 |
| Valid claims | 477 |
| Claims seeking lost time | 348 |
| Claims seeking credit monitoring | 350 |
| Opt-outs | 1 |
| Objections | 0 |
The pattern is clear from the breakdown: most claimants asked for lost time or credit monitoring, the two benefits that did not depend on proving an actual financial loss. Those counts were taken six days before the January 20, 2026 deadline, so the final totals could differ.
How the Court Approved It
Judge Edward G. Weil of the Superior Court of California, County of Contra Costa heard the final approval motion and class counsel’s fee request on February 5, 2026 and granted both. The signed approval order was filed February 20, 2026, and judgment on the settlement was entered February 24, 2026. Class counsel could request up to $150,000 in attorneys’ fees, costs and expenses.
The case is Star Joshua v. The County of Contra Costa, et al., Case No. C23-01684. It was filed in July 2023, after the County mailed its breach notices. The plaintiffs alleged that the County failed to protect personal information held in employee email accounts. The County and the other defendant deny all wrongdoing and liability, and the court made no finding that they did anything wrong.
What the Phishing Incident Exposed
The County identified an email phishing incident on September 20, 2022. According to the settlement notice, an unauthorized party may have accessed two County employee email accounts, including emails and attachments, between September 19 and September 20, 2022.
The County’s investigation found about 15,591 people potentially affected, and “Notice of Data Breach” letters went out on or about May 10, 2023 — nearly eight months after the incident was identified. That letter defined the class: everyone with a California mailing address who was mailed it on or about that date. The County Board of Supervisors and related entities, people who excluded themselves, and the judges on the case with their families and staff were excluded.
Timeline, From Phishing Email to Judgment
| September 19–20, 2022 | Period in which an unauthorized party may have accessed two employee email accounts. |
| September 20, 2022 | County identifies the phishing incident. |
| On or about May 10, 2023 | “Notice of Data Breach” letters mailed to about 15,591 people. |
| July 2023 | Lawsuit filed. |
| January 15, 2026 | Administrator’s declaration on notice and claims filed. |
| January 20, 2026 | Claim deadline. |
| February 5, 2026 | Final approval and fee motions heard and granted. |
| February 20, 2026 | Signed final approval order filed. |
| February 24, 2026 | Judgment entered. |
| February 24, 2027 | Settlement compliance hearing. |
What Valid Claims Will Receive
The Contra Costa County data breach settlement let each claimant choose one or more of three benefits, each with its own per-person cap:
| Ordinary expenses — up to $500 | Documented expenses traceable to the incident. Included lost time at $25 an hour for up to four hours ($100), which needed a short written description and an attestation rather than receipts. |
| Extraordinary losses — up to $5,000 | Documented losses from actual identity theft or fraud. |
| Credit monitoring | Two years of three-bureau monitoring through Equifax. Required only a claim. |
The notice set per-person caps and did not describe a shared settlement fund, so there is no pool to divide among claimants. The County also agreed to adopt certain data security measures as part of the deal.
For People Who Filed
There is nothing left to file. OpenClassActions.com had not located an official payment date as of September 26, 2026. Claimants should watch the official website, ContraCostaSettlement.com, for payment and credit monitoring updates, and use it to update their contact information if they have moved since filing.
The February 24, 2027 settlement compliance hearing is a point at which the court is scheduled to check on how the settlement is being carried out. The register of actions for Case No. C23-01684 is available through the Contra Costa County Superior Court’s public case portal. Our sister site will update its Contra Costa County data breach settlement page if a payment date is announced.
Frequently Asked Questions
Can I still file a Contra Costa County data breach claim?
No. The deadline was January 20, 2026, and the court has approved the settlement and entered judgment. Only people who filed a valid claim by the deadline will receive benefits.
How many people filed claims?
According to the administrator’s declaration, 512 claims had been received by January 14, 2026, six days before the deadline, and 477 of them were valid. Notices were mailed to 15,014 class members. One person opted out and no objections were received.
When will payments be made?
No official payment date had been located as of September 26, 2026. Claimants should check ContraCostaSettlement.com for payment updates and keep their contact information current there.
Did claimants need receipts?
Not for everything. Lost time of up to four hours at $25 an hour needed a written description and an attestation. Other ordinary expenses and identity theft losses needed documentation, and credit monitoring required only a claim.
Did the court find the County at fault?
No. The County and the other defendant deny all wrongdoing and liability. The court approved the settlement without deciding whether they did anything wrong.
Sources
- Official settlement website, court-approved notice and claim form — ContraCostaSettlement.com, administered by EAG Gulf Coast, LLC.
- Register of actions for Case No. C23-01684, Superior Court of California, County of Contra Costa, via the court’s public case portal.
- Declaration of the settlement administrator on notice and claims, filed January 15, 2026.
- Order granting final approval, filed February 20, 2026, and judgment entered February 24, 2026.
- OpenClassActions.com — Contra Costa County Data Breach Settlement.
Source and credit: the settlement terms, deadlines and benefit details described above are drawn from our sister site’s reporting — OpenClassActions.com: Contra Costa County Data Breach Settlement — Final Approval Granted — which tracks this case against the court-approved notice and the official settlement website and is updated as the court rules.
Legal Disclaimer
This article is for informational purposes only and is not legal advice. OpenClassActions.org is a consumer news site, not a law firm and not the settlement administrator, and is not affiliated with any party to the case described. The allegations are allegations; unless a court has ruled, the defendants deny wrongdoing and no court has decided the merits. Deadlines, benefit amounts and payment timing can change as the court and the administrator act, so confirm current status on the official settlement website. You never need to pay anyone to file a claim or to receive a settlement payment.