Finastra Technology $2,500 Data Incident Settlement for Oct 2024 Cyberattack

In October 2024, Finastra Technology—an industry firm that supports financial services with software and technology—suffered a targeted cyberattack in which unauthorized parties allegedly accessed files containing sensitive personal data. The exposed information reportedly included names, dates of birth, Social Security numbers, and financial account numbers, raising the risk of identity theft and fraud for affected individuals. Because many companies handle large volumes of consumer financial and identity data, incidents like this often trigger obligations under privacy and data-breach laws, including state notice requirements and broader cybersecurity expectations shaped by U.S. regulations and industry guidance. A class action lawsuit was filed to address allegations that Finastra did not adequately protect private information, and its settlement is significant because it establishes a defined path for impacted people to receive compensation and protective services. Under the agreement, eligible U.S. residents may claim up to $2,500 for certain documented out-of-pocket losses related to the breach, plus one year of credit monitoring and $1 million in financial fraud insurance through the settlement’s monitoring program. For those without documented losses, the settlement also includes a pro rata cash payment funded by the remaining settlement amount, and the total settlement fund is $3.13 million—meant to cover administration, attorneys’ fees, service awards, credit monitoring, and payments to class members. Cases like this fit a broader pattern in cybersecurity litigation: plaintiffs typically argue that inadequate safeguards led to unauthorized access, while companies frequently deny wrongdoing yet settle to avoid prolonged legal costs and uncertainty, reflecting how courts and regulators increasingly scrutinize data-security practices under evolving expectations for reasonable safeguards and breach response.