Settlement reached at last in VA data breach

Nearly three years after data on 26 million veterans went missing in the wake of a Maryland house burglary, the Department of Veterans Affairs and a group of suing vets have reached an agreement on the class-action suit filed by the latter. It's now up to a judge to ratify the settlement.

Under the terms of the agreement, the VA will set aside $20 million for paying the expenses of anyone directly affected by the breach, including credit-monitoring expenses and mental-health costs for those who found themselves in extreme emotional distress in the wake of the breach, which has resulted in no known abuse of the data. Payouts will range from $75 up to $1500.

The VA's 26 million headaches began when an analyst for the agency took home a laptop with the data on board. The laptop was among a number of items that went missing in that burglary; the analyst told his supervisors, but neither vets nor the then-head of the agency were let in on the secret for several weeks.

The subsequent investigation led to Congressional hearings, multiple VA firings, and a number of guidelines from the Office of Management and Budget concerning the proper handling of other peoples' data. The laptop eventually turned up, and analysis of the disk indicated that the thieves hadn't accessed the relevant files.