Cash App was ordered to pay $15 million to app users who faced a security breach resulting in the release of millions of users’ personal data.

Users can receive up to $2,500 for unauthorized or fraudulent activity on their Cash App accounts between Aug. 23, 2018, and Aug. 20, 2024. Users who have already been reimbursed by Block, Cash App Investing, or a third party do not qualify.

The breach occurred when one former Cash App employee downloaded users’ personal information without their knowledge.

The December 2021 data breach resulted “in the unauthorized public release of the personally identifiable information of 8.2 million current and former Cash App Investing customers,” according to the lawsuit.

Plaintiffs sued Cash App Investing and Block, saying the companies failed “to exercise reasonable care in securing and safeguarding consumer information.”

Users can submit a claim for out-of-pocket losses, lost time, and transaction losses.

For lost time, a user can submit a claim for up to three hours at a rate of $25 per hour for time spent dealing with the data breach. With out-of-pocket losses, a user must show that his or her account was involved in the data breach, and with a transaction loss, a user must show he or she lost money and has not been reimbursed.

Users should only submit one claim. Users with multiple accounts should list them on a single form.