Self Esteem Brands LLC (doing business as Purpose Brands) agreed to a class action settlement after a cybersecurity incident discovered in June 2024 allegedly exposed sensitive consumer data. According to the notices, the compromised information could include highly valuable identifiers—such as Social Security numbers, driver’s license or passport numbers, financial and payment card details, and even health and insurance information—data that can be used for identity theft, account takeovers, and fraudulent medical or financial claims. The incident is described as occurring over a lengthy window (Dec. 19, 2023, to June 6, 2024), highlighting a common modern breach dynamic: attackers may access systems for months before detection, increasing the amount of information potentially affected. The lawsuit was filed because consumers alleged the company failed to adequately protect their information and respond appropriately, seeking compensation for breach-related harms like out-of-pocket mitigation costs, time spent addressing the fallout, and unreimbursed fraud losses. While Self Esteem Brands denies wrongdoing, the settlement offers up to $2,000 for documented “ordinary” losses (including credit monitoring or credit freeze costs), up to $5,000 for documented “extraordinary” identity-theft losses when the breach is the likely cause, or a $25 alternative cash payment, plus two years of credit monitoring with $1 million in identity-theft insurance. Its significance is less about the dollar headline and more about how these cases operationalize breach recovery: they formalize documentation standards, set deadlines and opt-out rights, and often provide monitoring services even where individualized damages can be hard to prove. More broadly, this settlement fits a well-established pattern in U.S. data-breach litigation, where companies often resolve claims without admitting fault because trials are costly and outcomes are uncertain—especially when plaintiffs must show concrete injury beyond increased risk. Industry-wide, breaches involving Social Security numbers and financial identifiers frequently trigger notification duties under state data-breach laws, and the inclusion of health information can implicate additional privacy expectations and, depending on the entity’s role, potentially health-sector rules (e.g., HIPAA for covered entities and business associates). Similar class actions across retail, fitness, healthcare-adjacent, and financial services sectors reflect growing regulatory pressure and consumer scrutiny around “reasonable security,” with settlements increasingly pairing modest cash options with reimbursement tiers and credit-monitoring remedies to address both immediate expenses and longer-term identity-theft risk.