A June 2024 cyber incident at Elyria Foundry Holdings LLC (covering Elyria Foundry and Hodge Foundry) allegedly exposed personal data stored in company systems for current and former employees, as well as their spouses and dependents—2,193 people in total. Breaches like this matter because the information typically involved in HR files can be highly sensitive and durable (e.g., identifiers used for payroll and benefits), creating long-tail risks such as identity theft, fraudulent accounts, and the time and expense of monitoring and cleanup. The lawsuit was filed on the theory that Elyria failed to use reasonable data-security safeguards, allowing attackers to access personal information; Elyria denied wrongdoing but agreed to a $245,000 settlement to avoid the cost and uncertainty of litigation. Under the deal, class members who got a notice can choose reimbursement for documented losses (up to $400 for ordinary out-of-pocket costs, up to $5,000 for extraordinary identity-theft-related losses), lost-time payments (up to $80), or two years of credit monitoring with at least $1 million in identity-theft insurance, with a $60 alternative cash option for those who don’t claim other benefits—illustrating how modern breach settlements try to cover both direct financial harm and the practical burden of responding. More broadly, this case fits a busy national pattern of employee-data breach class actions where plaintiffs argue that lax cybersecurity and delayed detection create foreseeable harm, while companies often settle without admitting liability. The backdrop is a patchwork of U.S. privacy and breach-notification requirements—most states mandate notice to affected individuals, and employers handling certain categories of data may also face sector rules (such as HIPAA for health-plan information) or federal expectations from agencies like the FTC around “reasonable” security practices—so settlements like this reinforce the rising compliance pressure on manufacturers and other employers that historically treated HR data as an IT afterthought rather than a regulated, high-risk asset.