Hexpol Data Breach Settlement Offers Up to $5,250 for Stolen Personal Data

Hexpol Compounding Americas LLC and Hexpol Holding Inc. were hit by a December 2024 cyberattack that exposed sensitive personal information—including names and Social Security numbers—of about 1,723 people in the United States. According to the settlement notice, affected current and former employees who received breach notice may be eligible to recover money for identity theft–related problems, out-of-pocket costs, and time spent dealing with the fallout. This kind of data breach matters because Social Security numbers are often used to open new accounts or commit fraud, and victims may face immediate steps like credit monitoring, freezes, or contacting financial institutions to dispute suspicious activity. The lawsuit was filed as a class action that accused the companies of failing to adequately protect private data during the attack. By reaching a settlement, Hexpol agreed to provide compensation even while denying wrongdoing, a common outcome in cybersecurity cases because both sides weigh the expense and uncertainty of continued litigation against a faster, more predictable resolution for impacted individuals. The settlement offers several options—up to $5,000 for documented losses, up to 10 hours for documented time spent handling tax-related issues, a $70 alternative cash payment, and the election of three years of credit/fraud monitoring with $1 million in identity theft insurance—highlighting how remedies in U.S. breach disputes typically blend reimbursement with protective services. Broader implications include the growing pressure on employers and businesses to strengthen “reasonable security” and incident response after breaches, especially as U.S. state privacy and breach-notification laws require timely notice and as federal regulators increasingly scrutinize cybersecurity practices. Similar cases have repeatedly involved claims that companies didn’t implement sufficient safeguards to prevent unauthorized access or failed to respond adequately once intrusion was detected, and settlements like this one reflect a nationwide pattern of class actions seeking both consumer-facing support and compensation when highly sensitive identifiers such as Social Security numbers are exposed. For eligible class members, the key next step is filing a valid claim by the June 15, 2026 deadline, with final court approval scheduled for Aug. 11, 2026.