Nissan $1.5M Settlement for 2023 Employee Data Breach and Stolen SSNs

In this proposed class action settlement, Nissan North America agreed to create a $1.5 million fund to resolve claims arising from a November 7, 2023 cyberattack in which an attacker allegedly accessed Nissan’s network through an external VPN and stole files from shared drives. The exposed data was highly sensitive—employee Social Security numbers, dates of birth, pay information, and, for some people, medical records—and Nissan reported that about 53,038 current and former employees were affected. Although Nissan says no systems were encrypted, the theft and ransom demand reflect a common modern breach pattern: criminals target remote-access points and then exfiltrate data that can be used for identity theft and fraud. The lawsuit was filed because plaintiffs allege Nissan failed to use reasonable security measures to protect employee information and delayed notifying affected people, potentially increasing the risk of misuse. Without admitting wrongdoing, Nissan is offering class members a choice between (1) reimbursement for documented losses up to $4,500 (with higher payments tied to third‑party documentation such as police reports or bank records) or (2) a “no proof required” cash option up to $100 that may be reduced if many people claim, plus two years of one-bureau credit monitoring with up to $1 million in identity theft insurance. The case matters because it shows how data-breach class actions often turn on practical harm and mitigation—out-of-pocket costs, time spent responding to fraud, and the real-world value of monitoring—while also requiring class members to decide whether to participate or opt out to preserve individual rights. More broadly, this settlement fits into a wave of employee and consumer breach cases against large employers, where plaintiffs argue that organizations collecting SSNs and health-related data must meet heightened security expectations and provide prompt notice. Companies in the U.S. operate under a patchwork of state data-breach notification laws (and, for any medical information involved, potential HIPAA-related duties for covered entities or their vendors), and incidents are commonly reported to state regulators such as attorneys general—here, the Maine AG’s office reflected the scope of those impacted. Similar cases across industries often end with capped settlement funds, tiered payments for documented losses, and multi-year credit monitoring, reinforcing the message that remote-access security (like VPN controls), data minimization, and timely breach response are now core compliance and risk-management issues rather than purely IT concerns