Complete Payroll Solutions 2.6 million settlement for March 2024 data breach exposing personal data

In March 2024 Complete Payroll Solutions disclosed a cybersecurity incident that potentially exposed personally identifiable information — including names, addresses, Social Security numbers and financial data — for about 376,943 people. Plaintiffs brought a class action alleging negligence, breach of implied contract, invasion of privacy and unjust enrichment; CPS denies the allegations but agreed to a $2.6 million settlement that offers class members reimbursement for documented out‑of‑pocket losses up to $5,000, an estimated pro rata payment (about $100), and three years of one‑bureau credit monitoring. Key dates and mechanics matter: claimants need the class‑member ID from the notice, the claim deadline is June 18, 2026, and significant portions of the fund are earmarked for attorneys’ fees and administrative costs, which can reduce individual recoveries. Beyond this case, the settlement highlights broader trends and regulatory context for payroll processors and employers who handle sensitive employee data. Payroll vendors are high‑value targets because they store Social Security numbers and bank account details; federal guidance (FTC) and state breach‑notification and consumer‑protection laws increasingly require “reasonable” data‑security practices, prompt notice to affected individuals, and remediation measures. High‑profile breaches (Equifax, Anthem and other payroll/provider incidents) have produced similar class actions and remedies like credit monitoring, and this resolution reinforces industry best practices — stronger encryption, access controls, vendor oversight and incident response planning — while reminding affected individuals to file claims and monitor for identity theft.