TurboTax’s parent company, Intuit, is dealing with more than one active legal fight heading into the 2025-2026 tax season. The TurboTax lawsuit most directly tied to 2025 is a proposed data breach class action, Garite v. Intuit Inc., alleging the company failed to prevent a breach that exposed TurboTax and Credit Karma user data between December 2023 and February 2024.

The stakes are significant: Intuit serves well over 100 million customers across its TurboTax, Credit Karma, QuickBooks, and Mailchimp products, and the company previously paid $141 million to settle a separate FTC case over “free” filing advertising. That older case shows just how large Intuit settlements can get when regulators and plaintiffs’ firms get involved.

In this article, you’ll learn what the current TurboTax lawsuit actually alleges, whether you might qualify for compensation, how a payout would likely be calculated if the case resolves in plaintiffs’ favor, and how to tell a real claims process from misleading online content about “new” TurboTax settlements.

Here’s a fact that surprised even close court-watchers: the data breach at the center of this case reportedly wasn’t discovered until February 27, 2024 — roughly a week after the exposure window is alleged to have already closed.

Quick Facts: TurboTax Lawsuit 2025

Detail	Information
Plaintiff	Joseph Garite (proposed class representative)
Defendant	Intuit Inc.
Court	U.S. District Court for the Northern District of California, San Jose Division
Case Number	5:24-cv-03960
Case Type	Proposed consumer data breach class action
Core Allegation	Intuit failed to maintain reasonable data security, allowing a breach affecting TurboTax and Credit Karma users
Filing Date	July 1, 2024
Class Status	Not yet certified
Settlement	Not publicly disclosed; no settlement fund exists as of this writing

What Is the TurboTax Lawsuit 2025 About?

The TurboTax lawsuit generating the most attention going into 2025 is Garite v. Intuit Inc., a proposed class action filed in the Northern District of California. The suit alleges Intuit failed to maintain reasonable cybersecurity safeguards and adequately train employees, allowing a data breach that reportedly occurred between December 23, 2023, and February 21, 2024, but wasn’t discovered until February 27, 2024.

The case names TurboTax and Credit Karma — both Intuit products — as affected by the alleged breach, and argues that affected users’ personal information was put at risk as a result.

Key Takeaway: This is a data-security negligence case, not a dispute over TurboTax’s pricing or advertising — those are separate, previously resolved issues.

TurboTax Class Action Lawsuit: Legal Status Overview

The case remains a proposed class action, meaning no court has certified a class of affected users and no settlement has been reached. Intuit has not been confirmed in available reporting to have filed a public response addressing the merits of the allegations.

• Plaintiff: Joseph Garite, a former TurboTax customer.

• Defendant: Intuit Inc.

• Court: U.S. District Court for the Northern District of California, San Jose Division.

• Filed: July 1, 2024.

Key Takeaway: Because this case was filed in mid-2024 and remains active heading into 2025-2026, it’s the most current genuine TurboTax class action with an open, unresolved legal status.

Latest Update 2026

Date	Development
Dec. 23, 2023 – Feb. 21, 2024	Alleged data breach window affecting TurboTax and Credit Karma users
Feb. 27, 2024	Breach reportedly discovered
July 1, 2024	Garite v. Intuit Inc. filed in N.D. Cal. (Case No. 5:24-cv-03960)
2025	Case proceeds through early litigation; no certified class or settlement reported
March 20, 2026	The Fifth Circuit vacates the FTC’s cease-and-desist order tied to Intuit’s “free” TurboTax advertising, ruling the FTC cannot adjudicate the claims through its own internal administrative process
Mid-2026	Multiple securities fraud lawsuits are filed against Intuit on behalf of shareholders after the company disclosed weak tax-season revenue and its stock dropped roughly 20%

Key Takeaway: The Fifth Circuit ruling doesn’t resolve the underlying “free filing” dispute — it sends the FTC’s case to a different court process, meaning that older regulatory fight isn’t fully over either.

Key Allegations: Data Breach and Security Failures

According to reporting on the Garite complaint, the core allegations include:

1. Intuit failed to maintain reasonable and industry-standard data security safeguards.

2. Intuit failed to adequately train employees on cybersecurity practices.

3. A breach affecting TurboTax and Credit Karma user data occurred between late December 2023 and late February 2024.

4. The breach was not discovered until several days after the alleged exposure window closed.

5. Affected users’ personal information was put at increased risk of identity theft and fraud as a result.

Separately, some secondary legal-news sites have described a different lawsuit — sometimes styled “Diaz v. Intuit” and dated to July 2025 — alleging Intuit ignored internal warnings about fraudulent tax filings. That reporting reuses plaintiff names (Christine Diaz and Michelle Fugatt) that match an older, already-settled 2015 case (In re Intuit Data Litigation, No. 5:15-cv-01778, N.D. Cal., resolved in 2019). We could not independently verify a genuinely new 2025 court filing under that case name, so readers should treat claims about a “new 2025 Diaz identity-theft lawsuit” with caution until confirmed against a primary court docket.

Key Takeaway: Not everything labeled a “2025 TurboTax lawsuit” online is a new case — some secondary sites appear to recycle older, resolved litigation under a new publication date.

Is TurboTax Actually Responsible for the Data Breach?

This is the central question the Garite litigation will need to resolve, and it remains unsettled. Intuit has not been confirmed to have publicly conceded fault for the alleged breach, and no court has yet ruled on the merits of the security-failure claims.

Data breach cases like this one often hinge on whether the company’s security measures met an industry-standard “reasonableness” bar — a fact-intensive question that typically isn’t resolved until well into litigation or a settlement negotiation.

Key Takeaway: A filed complaint states allegations, not proven facts — Intuit is entitled to contest every element of the claim.

Company Background: How the Issue Started

Intuit’s TurboTax, Credit Karma, QuickBooks, and Mailchimp platforms collectively handle enormous volumes of sensitive financial and personal data. That scale is part of why Intuit has faced a recurring pattern of privacy and security litigation in recent years, distinct from its older advertising-practices disputes.

Intuit has also faced separate 2026 lawsuits alleging security failures tied to Credit Karma Money accounts and allegations that TurboTax’s Refund Advance loans carried excessive annual percentage rates for military members — both filed after the Garite case and reflecting a broader pattern of scrutiny on Intuit’s consumer-facing products.

Consumer Complaints and BBB Records

Widespread, independently verified consumer complaints specifically tied to the December 2023–February 2024 breach were not identified in the sources reviewed for this article. Most of the current public record comes from the litigation itself and legal trade press coverage rather than a broad wave of documented BBB complaints.

Key Takeaway: Don’t assume a large public complaint record exists yet for this specific breach — treat court filings and established legal news outlets as the primary source of verified information.

Who Qualifies for the TurboTax Lawsuit? Eligibility Criteria

No class has been certified in the Garite case, so there is no confirmed list of who qualifies for compensation. Based on the allegations, eligibility would likely extend to:

• TurboTax users whose personal data was allegedly exposed in the December 2023–February 2024 breach window

• Credit Karma users affected by the same alleged incident

• Individuals who can show they suffered harm (such as identity theft or fraud attempts) tied to the breach

Separately, the TurboTax/Twilio privacy arbitration campaign run by the law firm Labaton Keller Sucharow describes eligibility as anyone who used TurboTax within roughly the last three years, though this is an individual arbitration recruitment effort, not a certified class action or court-approved settlement.

Key Takeaway: Until a judge certifies a class or a settlement is reached in Garite v. Intuit, this list describes who the lawsuit is trying to represent — not who is guaranteed a payout.

TurboTax Lawsuit Settlement Amount: Payout Estimates

No settlement has been reached in the Garite data breach case, and no dollar figure for a payout has been publicly disclosed. For context, Intuit’s earlier, separate FTC “free filing” settlement totaled $141 million, distributed to roughly 4.4 million consumers with per-person payments generally in the $29 to $85 range depending on how many tax years qualified — but that settlement is unrelated to the current data breach case and is now fully closed.

Case	Payout Status
Garite v. Intuit (2024 data breach)	No settlement; no payout amount publicly disclosed
FTC “free filing” settlement (2022)	Closed; $141 million distributed, average payments $29–$85 per eligible year
TurboTax/Twilio privacy arbitration campaign	Reported potential payments up to $2,500 per claim, but this is individual arbitration, not a guaranteed settlement

Key Takeaway: The $141 million figure you may see cited for “TurboTax lawsuit 2025” content refers to an older, already-completed settlement — not a new payout tied to the current data breach case.

How a Payout Would Be Calculated

If the Garite case eventually settles or proceeds to a liability finding, payouts in comparable data breach class actions have typically been calculated using:

• A base payment available to all class members who submit a valid claim

• Additional reimbursement for documented out-of-pocket losses tied to identity theft or fraud

• Possible reimbursement for time spent addressing the breach’s effects, in some comparable settlements

This reflects a general pattern from similar data breach litigation, not a confirmed formula for this specific case.

How to File a Claim (Current Options)

There is no court-approved claims process for the Garite data breach case because no settlement exists yet. Currently, the only active claim-style option tied to TurboTax privacy issues is the Twilio SDK arbitration campaign, which works differently from a class action:

1. You sign up through the law firm’s intake portal and enter an attorney-client relationship.

2. The firm evaluates your usage history and potential claim.

3. If pursued, your claim proceeds through individual arbitration against Twilio rather than a public class action against Intuit.

4. Outcomes are confidential and not guaranteed — arbitration can result in payment, no payment, or a ruling against the claimant.

Key Takeaway: Signing up for an arbitration intake is not the same as filing a claim in an approved class settlement — know which process you’re entering before providing personal information.

Filing Deadline and Statute of Limitations

There is no settlement claims deadline for the Garite case because no settlement has been reached. Separately, data breach and consumer protection claims generally carry statutes of limitations that vary by state and legal theory, often in the range of two to four years from discovery of the harm.

If you believe you were personally harmed by the alleged TurboTax/Credit Karma breach, consult a consumer protection or data privacy attorney about the specific deadline that applies to your situation rather than relying on general estimates.

Is There a TurboTax Lawsuit Scam to Watch For?

The underlying Garite lawsuit and the older $141 million FTC settlement are both real and well documented through court records and legal news coverage. What consumers should watch for are websites conflating the closed $141 million settlement, the active Twilio arbitration campaign, and unverified claims about “new 2025” identity-theft lawsuits into a single, confusing (and sometimes misleading) narrative.

Since no new class-wide settlement fund exists for the current data breach case, any site asking for payment or sensitive personal information to “claim your TurboTax lawsuit payout” today should be treated with skepticism unless it clearly identifies which specific, verified case it refers to.

Other Related TurboTax Lawsuits and Broader Context

Beyond the Garite data breach case, Intuit faces several other legal matters relevant to TurboTax users and shareholders:

• A 2026 lawsuit alleging Intuit’s TurboTax Refund Advance loans carried military annual percentage rates exceeding legal caps.

• A 2026 lawsuit alleging Intuit and Credit Karma failed to properly secure Credit Karma Money accounts.

• Multiple 2026 securities fraud lawsuits filed on behalf of Intuit shareholders after the company’s stock dropped roughly 20% following weak tax-season revenue disclosures.

• The now-resolved Fifth Circuit appeal over the FTC’s “free filing” advertising order, which was vacated in March 2026 and sent back through a different court process.

If you’ve researched the earlier [TurboTax free filing settlement](https://lawfold.com/turbotax-lawsuit/), note that it is fully closed and separate from the active data breach litigation covered here.

Frequently Asked Questions

What is the TurboTax lawsuit 2025 about?

The TurboTax lawsuit most closely tied to 2025 is Garite v. Intuit Inc., a proposed class action filed in July 2024 in the Northern District of California, alleging Intuit failed to maintain reasonable data security and allowed a breach affecting TurboTax and Credit Karma users between December 2023 and February 2024. Intuit has not been confirmed to have responded to the allegations on the merits as of this writing.

Who qualifies for the TurboTax lawsuit?

No class has been certified in the Garite case, so there is no confirmed eligibility list. Based on the complaint’s allegations, TurboTax and Credit Karma users whose data was affected by the December 2023–February 2024 breach may eventually qualify if a class is certified or a settlement is reached, but this is not yet guaranteed.

How much is the TurboTax lawsuit settlement worth?

No settlement has been reached in the current data breach case, so there is no confirmed payout amount. Intuit’s earlier, unrelated FTC settlement over “free filing” advertising totaled $141 million and paid eligible consumers roughly $29 to $85 per qualifying tax year, but that case is closed and separate from the active 2024-filed data breach litigation.

Is the TurboTax/Twilio privacy claim the same as a class action lawsuit?

No. The Twilio SDK privacy option is an individual arbitration campaign run by a private law firm, not a certified class action or a court-approved settlement. Signing up means entering an attorney-client relationship and pursuing an individual arbitration claim against Twilio, with outcomes that are confidential and not guaranteed, unlike a public class action against Intuit directly.

What is the filing deadline for the TurboTax lawsuit?

There is no settlement claims filing deadline because no settlement fund currently exists for the Garite data breach case. If a settlement is eventually reached, the court will set a specific claims deadline as part of the approval process, and consumers should follow official court filings or established legal news sources rather than relying on unofficial deadline claims found online.

Read: Costco Auto Renewal Lawsuit
Read: Mario Lopez Lawsuit
Read: Carnival Tequila Lawsuit
Read: Isotonix Lawsuit
Read: Chobani Lawsuit

What TurboTax Users Should Do Now

The TurboTax lawsuit landscape heading into 2025-2026 is more crowded than a single headline suggests: a closed $141 million settlement, an active data breach class action in Garite v. Intuit, a separate arbitration campaign over Twilio tracking technology, and newer 2026 disputes over Refund Advance loans and Credit Karma security. There is no new, active class settlement fund tied to the current data breach case as of this writing.

If you used TurboTax or Credit Karma between December 2023 and February 2024, the most useful step right now is documenting any signs of identity theft, unusual account activity, or fraud attempts tied to that period. That record could matter if the Garite case eventually settles.

Before you do anything else:

• Save records of any suspicious account activity or identity theft reports from the December 2023–February 2024 window

• Understand whether a site is describing the closed $141 million settlement, the active Garite lawsuit, or the separate Twilio arbitration campaign before providing any personal information

• Avoid sites that ask for payment to “join” a TurboTax lawsuit

• Follow updates through court dockets or established legal news outlets rather than unverified secondary blogs

This case is worth watching, not acting on with urgency, since no confirmed settlement or claims deadline currently exists. As the Garite litigation develops, any official claims process will be announced through the court, not through unsolicited claim forms.

Sources: Law360 Tax Authority, Top Class Actions, ClassAction.org, Forbes, Lieff Cabraser, Labaton Keller Sucharow (Lantern), Bleichmar Fonti & Auld LLP, and additional reporting on Garite v. Intuit Inc., Case No. 5:24-cv-03960 (N.D. Cal.), the FTC’s 2022 TurboTax “free filing” settlement, and the Fifth Circuit’s March 2026 ruling vacating the FTC’s cease-and-desist order against Intuit.