Varsity Brands 6.5M Settlement for May 2024 Data Breach Exposing Personal Data

Varsity Brands—best known for cheerleading and dance apparel, uniforms, and event services—was hit by a cybersecurity incident in May 2024 that allegedly exposed individuals’ personal data. Data breaches like this have become common as retailers and service providers store large volumes of customer and employee information, and attackers increasingly target organizations connected to youth activities and schools. According to the settlement site, eligible people whose information was involved can file a claim for payments ranging from $100 to $6,500, with a claim deadline of 4/15/26 and no proof required, reflecting a structure often used when many affected consumers may not have out-of-pocket documentation. The class action was filed to resolve claims that the company failed to adequately protect sensitive information and to compensate impacted individuals for time spent addressing the incident, potential identity-theft risk, and related losses—without requiring each person to sue individually. Its significance lies in how it reinforces a growing expectation that companies implement “reasonable” security controls (such as access management, monitoring, and encryption) and provide timely notice when incidents occur, an obligation shaped by state breach-notification laws and, in many cases, regulatory scrutiny from the FTC over allegedly unfair or deceptive data-security practices. Similar consumer breach settlements across industries frequently follow the same pattern—cash tiers for ordinary impacts and higher amounts for documented losses—signaling that cybersecurity failures can carry real financial consequences beyond remediation costs, while also nudging organizations toward stronger compliance programs as U.S. privacy and security rules continue to tighten in a patchwork of state and sector-specific requirements.