Patelco Credit Union $7.25 Million Data Breach Settlement Up to $5,000

In June 2024, Patelco Credit Union discovered a cyber incident in which unauthorized actors allegedly accessed members’ personal information. With notifications sent around August 2024, the breach was estimated to affect about 1 million current and former members—meaning roughly a large share of people who rely on credit unions to safeguard highly sensitive data like names, account-related information, and other personally identifiable details. The lawsuit that followed culminated in a proposed $7.25 million settlement, offering members who received a breach notice a claim for up to $5,000 to cover certain documented losses (such as credit monitoring or fees related to freezing/unfreezing credit) and, for others who don’t file for specific losses, a smaller pro rata cash payment estimated between $100 and $200. The case was filed as a class action to make it easier for many affected individuals to seek compensation at once, rather than pursuing separate claims. Patelco agreed to settle $7.25 million even while denying wrongdoing, largely to avoid the uncertainty, cost, and delays of continued litigation. For claimants, the significance is practical: they have a defined path to recover out-of-pocket expenses, with a claim deadline of June 11, 2026, and payments expected about 60 days after final court approval. More broadly, settlements like this reflect a growing wave of consumer data-breach litigation, shaped by industry expectations and rules such as the FTC Act’s prohibition on unfair or deceptive practices, state privacy laws (including breach notification requirements), and federal banking/financial-security guidance that generally expects institutions to maintain reasonable safeguards and respond promptly when data incidents occur. This kind of settlement also underscores how financial institutions are increasingly judged on cybersecurity preparedness—because breaches can trigger both direct harms (fraud, identity theft costs) and administrative burdens (monitoring, identity-freeze procedures) for large populations. Similar cases against banks, credit unions, and other data holders often turn on questions like what protections were in place, whether access was promptly detected, and whether monitoring and notification were timely and accurate. In this settlement, eligible members use the notice ID and confirmation code to file, and the money pool is structured to cover administration, attorneys’ fees (up to $2.5375 million), service awards, and payments to approved claimants, illustrating how class actions translate complex cyber events into regulated, claim-based relief—up to the maximum provided under the agreement.