Millions of Americans could soon receive money after Communication Federal Credit Union (CFCU) agreed to a multi-million-dollar settlement tied to a major data breach discovered in early 2024.
The credit union has reached a $2.9 million deal to resolve a federal class action lawsuit, aiming to compensate people whose personal information was exposed during a cyber intrusion at the end of 2023 and the start of 2024. The case highlights just how expensive data security failures have become for financial institutions and their members.
What happened in the CFCU data breach?
The security incident took place over an 11-day stretch between late December 2023 and early January 2024. During that period, attackers accessed files containing highly sensitive personal and financial data.
According to the lawsuit, the exposed information included:
- Names
- Addresses
- Dates of birth
- Social Security numbers
- Driver’s license details
- Bank account numbers
- Payment card data
Plaintiffs argued that the breach could have been avoided if the credit union had implemented stronger security safeguards. CFCU, for its part, denied any legal wrongdoing but ultimately chose to settle instead of fighting the case in court for years.
How much is the settlement worth?
The total settlement fund is valued at $2.9 million. That money will be used to pay:
- Class member claims (both reimbursement and flat cash payments)
- The cost of providing credit and identity monitoring services
- Other court-approved expenses related to the case
What each person receives will depend on their individual situation and the total number of valid claims submitted.
Who is eligible for compensation?
You may be part of the settlement class if your personal information was involved in the CFCU data breach that occurred between late December 2023 and early January 2024.
The settlement is designed for consumers across the United States whose data was accessed in the cyber intrusion. If you received a notice about the breach or the settlement, that is a strong sign you are included in the class.
What can class members receive?
The settlement offers two main types of monetary relief, plus free identity protection for everyone who qualifies.
1. Reimbursement for out-of-pocket losses — up to $7,500
If you spent your own money dealing with the fallout of the breach, you may be able to claim up to $7,500 in documented losses.
Covered costs can include:
- Identity restoration and recovery services
- Credit monitoring or credit report fees you paid
- Fees or costs to replace government-issued IDs
- Losses tied to unauthorized financial activity or fraud
To receive this higher level of payment, you will need to provide documentation showing what you spent and how it connects to the breach.
2. Standard cash payment — estimated around $125
Even if you did not suffer measurable financial losses, you may still qualify for a cash payment.
Class members who cannot document specific expenses can request a standard settlement payment. Current estimates put that amount at about $125 per person, but the final figure could be higher or lower depending on how many people file claims and how the court allocates the funds.
3. Free credit monitoring and identity protection
Every eligible person will also receive three years of identity monitoring and credit protection at no cost.
This protection package includes:
- Ongoing credit monitoring
- Alerts for suspicious activity
- Up to $1 million in identity theft insurance
This type of coverage has become increasingly common in data breach settlements, as companies acknowledge that stolen personal data can lead to fraud months or even years after the original incident.
Key deadlines you need to know
The settlement is now in the final approval phase, and there are several important dates for class members:
- Deadline to object or opt out:
If you want to object to the settlement terms or exclude yourself from the settlement altogether, you must do so by November 21, 2025. - Final approval hearing:
The judge overseeing the case is scheduled to hold a final approval hearing on January 7, 2026. At that hearing, the court will decide whether to grant final approval to the settlement. - Deadline to file a claim:
To receive money or benefits, you must submit your claim form by December 22, 2025.
If you do not file a claim by the deadline, you will likely miss out on both cash payments and free identity protection, even if your information was part of the breach.
How to apply for your payment
To request benefits under the settlement, eligible class members must submit a claim form by the December 22, 2025 deadline.
Depending on your situation, you will:
- Choose whether you are seeking reimbursement for documented out-of-pocket losses (up to $7,500), a standard cash payment, or both (as allowed under the settlement terms).
- Provide documentation for any claimed expenses, such as receipts, bank statements, or other records showing identity theft-related costs or unauthorized transactions.
- Confirm your contact details and preferred payment method, if that option is provided on the claim form.
Payments will be made from the $2.9 million settlement fund after the court grants final approval and all claims are processed. The exact timing of payments will depend on how long it takes to review claims and resolve any disputes.
Why this settlement matters
The CFCU settlement is another reminder that data breaches are not just technical hiccups — they have real-world consequences for consumers.
For affected members, the deal offers:
- A chance to recover money spent dealing with fraud or identity issues
- Direct cash compensation even if no obvious loss occurred
- Long-term identity monitoring and insurance to guard against future problems
For financial institutions, the case underscores the growing legal and financial risks tied to cybersecurity lapses. A single 11-day intrusion has now led to years of litigation and a multi-million-dollar payout.
If you think your information may have been caught up in the CFCU breach, it is worth checking whether you are part of the settlement class and, if so, submitting a claim before the deadline. Missing the window could mean leaving money — and valuable identity protection — on the table.