CBIZ Data Breach Settlement

People who were mailed a notice about the CBIZ Benefits & Insurance Services data incident may claim. This settlement resolves In re CBIZ Data Breach Litigation, Case No. 1:24-cv-01722-DCN, in the U.S. District Court for the Northern District of Ohio, over a 2024 incident in which an unauthorized party accessed information CBIZ maintained, including in some cases names and Social Security numbers. The court-authorized Notice puts the class at roughly 19,990 people. Four things are worth getting straight before you file. First, the two benefits stack — this one is cumulative, not an either-or choice. Most data breach settlements make you pick between a flat payment and documented losses. This one does not. The Notice says valid claims for Out-of-Pocket Losses and pro rata cash payments “may be combined”, so if you have documented losses you should claim them and request the cash payment on the same form. Second, the “$100” is an estimate, not a fixed amount. It is a pro rata share described in the Notice as “approximately $100 (assuming a claims rate of 10% of the roughly 19,990-person Settlement Class)”, adjusted up or down after attorneys' fees, administrative expenses, service awards and all valid loss claims are paid. More claimants means less per person. Third, the $5,000 caps one benefit, not the settlement — and a second cap sits on top of it. The $5,000 is a per-person ceiling on documented Out-of-Pocket Losses only. Separately, if all valid loss claims together exceed 50% of the Net Settlement Fund, every loss payment is cut pro rata. The figure that actually bounds this settlement is $485,000 — the Defendant's entire obligation, which the Notice says also covers attorneys' fees of up to $161,666.67, up to $20,000 in costs, service awards of up to $5,000 for each Class Representative, and all notice and administration. Across roughly 19,990 people, that is a small fund. Fourth, the mailed notice is the class definition, and most class members never worked for CBIZ. Class membership is verified against the Administrator's mailed list, and you need the Login ID from your postcard to file. CBIZ Benefits & Insurance Services administers benefits for other employers, so the typical class member is a current or former employee of a CBIZ client company, not of CBIZ. Note also that the Defendant is the benefits and insurance subsidiary — not CBIZ, Inc., the publicly traded accounting and advisory parent. Two more things to know: there is no credit monitoring benefit in this settlement at all, and the deadline to opt out or object is November 24, 2026, a month before the December 24 claim deadline.

Do I Qualify?

You may be eligible if:

• CBIZ Benefits & Insurance Services, Inc. mailed you a notice saying your Private Information may have been compromised in the Data Incident that occurred in 2024. That is the entire class definition
• You can be verified on the list. The Notice says eligible Class Members will have been mailed notice of their eligibility by the Settlement Administrator and that class membership will be verified against that mailed list. There is no alternative route in, so if no notice was mailed to you, you are not a class member
• You do NOT need to have worked for CBIZ. This is the most common misconception about this case. CBIZ Benefits & Insurance Services administers benefits and insurance for other employers, so most class members are current or former employees of CBIZ's client companies whose names, Social Security numbers and dates of birth CBIZ held. Your employer is irrelevant — the mailed notice is what decides it
• It has to be THIS entity and THIS incident. The Defendant is CBIZ Benefits & Insurance Services, Inc., the benefits and insurance subsidiary, not CBIZ, Inc. the publicly traded accounting and advisory parent company, and not any other matter involving the CBIZ name
• Any US state. The class has no state restriction and the benefits do not vary by state, though the case is in the Northern District of Ohio and the Final Approval Hearing is in Cleveland
• You can get your Login ID. The Notice says you will need the Login ID from the front of your postcard to fill out a Claim Form, and to contact the Settlement Administrator if you do not know it. Handle this first if the postcard is gone: (866) 719-5560 or info@CBIZDataBreachSettlement.com
• You do NOT need to have lost any money to claim the pro rata cash payment. The Notice states that class members do not need to suffer Out-of-Pocket Losses to be eligible to file a claim for a pro rata cash payment, and that payment needs no documentation
• You do NOT have to give up the cash payment to claim your losses, or the reverse. The two benefits may be combined on one form — claim both if both apply to you. Receipts are needed only for the losses portion
• You are not in an excluded group. The exclusions are narrow: anyone who validly opts out, the Judge assigned to evaluate the fairness of the Settlement along with Court staff assigned to the case, Defendant's officers and directors, and anyone found criminally guilty of initiating, causing, aiding or abetting the Data Incident
• You submit a valid Claim Form by December 24, 2026 — online on or before that date, or mailed with a postmark no later than that date. November 24, 2026 is the separate, earlier deadline to opt out or object

There are two separate gates here, and they work differently. Gate one: getting into the claim form at all. The Long Form Notice states that “you will need the Login ID provided on the front of your postcard Notice to fill out a Claim Form,” and that if you do not know your Login ID you should contact the Settlement Administrator. This gate applies even to the cash payment, which otherwise needs no records at all. Class membership is separately verified against the list the Administrator mailed, so the notice matters twice over. If you believe you are a class member but the postcard is gone, your first move is to contact Simpluris — (866) 719-5560 toll-free or info@CBIZDataBreachSettlement.com — and do it well before December 24, 2026 rather than in the final week. Gate two: documenting the benefit you claim. This splits cleanly. The pro rata cash payment requires no receipts and no losses whatsoever — the Notice states that class members do not need to suffer Out-of-Pocket Losses to be eligible to file for it. Only the up-to-$5,000 Out-of-Pocket Losses benefit needs records. Because the two benefits may be combined, there is no downside to requesting the cash payment regardless of what your paperwork looks like. What counts as documentation for a loss claim. The Notice requires three things: your name and current address; documentation reasonably supporting the claim; and a brief description of the nature of the loss if that is not apparent from the documentation alone. Supporting documentation can include receipts or other documentation not “self-prepared” by the class member. The Notice is explicit that self-prepared documents such as handwritten receipts are, by themselves, insufficient to receive reimbursement, though they can be considered to clarify or support other submitted documentation. It states flatly that undocumented claims will be denied. Third-party records — bills, bank statements, invoices — are what the settlement contemplates. What the loss benefit covers. Losses must be fairly traceable to the Data Incident, or unreimbursed expenses incurred in or after 2024 and related to it, up to a total of $5,000 per class member. The Notice lists, without limitation: unreimbursed losses relating to fraud or identity theft; professional fees including attorneys' fees, accountants' fees and credit repair fees; costs of freezing or unfreezing credit with a credit reporting agency; credit monitoring costs incurred on or after the Data Incident through the date of claim submission; miscellaneous expenses such as notary, fax, postage, copying, mileage and long-distance telephone charges; and other mitigative costs fairly traceable to the incident incurred in or after 2024 through the date of claim submission. Even a fully documented loss claim can be cut. If the aggregate of all valid Out-of-Pocket Loss claims exceeds 50% of the Net Settlement Fund, each class member's loss payment is reduced pro rata so the total stays within that 50%. Documentation gets your claim approved; it does not guarantee payment of the full amount. Every claim is subject to the Administrator's verification process.

What Happened?

CBIZ Benefits & Insurance Services, Inc. provides benefits and insurance services to other employers. In that role it maintained personal information belonging to those employers' current and former employees, which is why most people in this class never worked for CBIZ itself.

According to the court-authorized Notice, a data incident occurred in 2024 in which an unauthorized party accessed information maintained by CBIZ, including in some cases names and Social Security numbers, which the Notice collectively calls “Private Information.” Note that neither the Notice nor the Settlement Agreement narrows the timing beyond the year: the Agreement's recitals define the “Data Incident” simply as “a cyber security incident that CBIZ experienced in 2024.” Dates more specific than that circulate in secondary coverage of this breach, but they do not appear in these court documents, so this page does not state one.

The Plaintiffs — Richard Giddings, Chanelle Zimmerman and Tina Fasano — allege that CBIZ failed to adequately secure its network and that, as a result, an unauthorized party was able to access CBIZ's systems and acquire sensitive personal information belonging to the plaintiffs and other putative class members. CBIZ denies all claims of wrongdoing or liability and contends that it has maintained and continues to maintain reasonable and adequate information security practices. The Settlement does not establish who is correct, and no court has found CBIZ at fault.

The case is In re CBIZ Data Breach Litigation, Case No. 1:24-cv-01722-DCN, in the United States District Court for the Northern District of Ohio, Eastern Division, before Judge Donald C. Nugent. The Settlement Agreement's recitals set out the procedural history: Plaintiffs filed a Consolidated Amended Complaint on January 8, 2025; CBIZ moved to dismiss it on February 24, 2025; and on June 2, 2025 the Court granted that motion in part and denied it in part, sustaining in part the negligence claim and dismissing the remaining claims. CBIZ answered on July 9, 2025, denying liability and asserting numerous affirmative defenses. That ruling matters for reading the settlement: by the time the parties negotiated, negligence was the only surviving theory. Following discovery the parties reached this settlement through arm's-length negotiations including a mediation before Michael Hawkins. The Court then granted preliminary approval and recognized the case as one that should be treated as a class action for settlement purposes, which opened the claim period.

The Court appointed Terence R. Coates of Markovits, Stock & DeMarco, LLC and Jeffrey S. Goldenberg of Goldenberg Schneider, LPA as Lead Class Counsel. Class members are not charged for these lawyers. Lead Class Counsel will not seek more than one-third of the Settlement Fund, $161,666.67, in attorneys' fees plus any accrued interest, and up to $20,000 in litigation costs and expenses, and will request a Service Award of up to $5,000 for each Class Representative. The Court will decide the proper amounts and may award less than requested.

The structure is a capped total rather than a per-claimant guarantee. The Notice states the maximum total amount Defendant may be required to pay is $485,000.00, inclusive of loss reimbursements, cash payments, attorneys' fees and costs, service awards, and notice and administrative costs, and that in no event shall Defendant's total financial obligation exceed that sum. The pro rata cash payment is therefore whatever is left after those deductions, divided among claimants.

Simpluris is the Settlement Administrator, reachable at (866) 719-5560 or info@CBIZDataBreachSettlement.com, or by mail at In re CBIZ Data Breach Litigation, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799.

The Final Approval Hearing is scheduled for January 13, 2027 at 9:00 a.m., when the Court will decide whether the Settlement is fair and rule on the fee and service award requests. The Notice warns that no settlement benefits or payments will be provided unless the Court approves the Settlement and it becomes Final, and that approved claims will be paid after all appeals and other reviews, if any, are completed. Payment is by check unless a class member chooses electronic payment, and all checks expire and become void 180 days after issuance.

How to File Your Claim

1. FILE AT CBIZDATABREACHSETTLEMENT.COM — the official settlement website, administered by Simpluris. The claim form is at the “File a Claim” link on that site
2. YOU NEED THE LOGIN ID FROM YOUR POSTCARD NOTICE. The Long Form Notice states plainly: “You will need the Login ID provided on the front of your postcard Notice to fill out a Claim Form. If you do not know your Login ID, please contact the Settlement Administrator.” Do that first if the postcard is gone — call (866) 719-5560 toll-free or email info@CBIZDataBreachSettlement.com. Class membership is checked against the Administrator's mailed list either way, so the notice is effectively the key to filing
3. CLAIM BOTH BENEFITS ON THE SAME FORM IF BOTH APPLY TO YOU. This settlement is not structured as an either-or election. The Notice says valid claims for Out-of-Pocket Losses and pro rata cash payments “may be combined,” and that “a Class Member may submit a claim for Out-of-Pocket Losses and a claim for a pro rata cash payment.” Request the cash payment even if you also itemize losses
4. THE CLAIM DEADLINE IS DECEMBER 24, 2026 — online Claim Forms must be submitted on or before that date, and mailed Claim Forms must be postmarked by that date
5. WATCH THE EARLIER DEADLINE — NOVEMBER 24, 2026. Opting out and objecting both close a full month before claims do. An exclusion request must be mailed and personally signed, and cannot be made by phone or email. Anyone who waits until the December 24 claim deadline to decide whether to stay in the class will have already lost that choice
6. FILE ONLINE IF YOU WANT ELECTRONIC PAYMENT. Paper claims are paid by check. Checks expire and become void 180 days after they are issued
7. IF YOU ITEMIZE LOSSES, ATTACH THIRD-PARTY RECORDS. The Notice requires documentation reasonably supporting the claim, and says self-prepared documents such as handwritten receipts are, by themselves, insufficient. Undocumented loss claims will be denied
8. A PAPER CLAIM FORM can be requested from the Settlement Administrator by phone at (866) 719-5560, by email at info@CBIZDataBreachSettlement.com, or by mail at In re CBIZ Data Breach Litigation, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799
9. DO NOT CALL THE COURT. The Notice asks class members not to contact the Court, the Clerk, the Judge or CBIZ with questions about the settlement or the claims process.
10. Visit the official claim form: https://www.cbizdatabreachsettlement.com/

How Much Will I Actually Get?

THE TWO BENEFITS STACK — THIS IS A CUMULATIVE SETTLEMENT, NOT AN EITHER-OR ELECTION. Get this right, because it is the reverse of how most data breach settlements on this site work. The Long Form Notice states that valid claims for Out-of-Pocket Losses and pro rata cash payments “may be combined,” and that “a Class Member may submit a claim for Out-of-Pocket Losses and a claim for a pro rata cash payment.” There is no provision making the flat cash available only in lieu of documented losses. A class member with $400 in documented, traceable losses can claim that $400 and the cash payment on top of it. THE “$100” IS AN ESTIMATE, NOT A FIXED AMOUNT, AND IT IS THE PART MOST LIKELY TO DISAPPOINT. The cash payment is a pro rata share, not a set figure. The Notice describes it as “approximately $100 (assuming a claims rate of 10% of the roughly 19,990-person Settlement Class)” and says it “will be adjusted up or down to account for the money remaining in the Settlement Fund after the payment of attorneys' fees and costs, Administrative Expenses, Class Representative Service Awards, and valid claims for Out-of-Pocket Losses.” Four separate deductions come out before the cash payments are computed, and the number of people who file moves the figure in both directions — more claimants means less each. Nobody, including the Administrator, can tell you today what this will actually pay. THE $5,000 CEILING APPLIES TO ONE BENEFIT ONLY, NOT TO THE SETTLEMENT. The $5,000 is a per-class-member cap on reimbursement of documented Out-of-Pocket Losses. It is not the value of this settlement, not a fund, and not an amount anyone is being offered. Reaching anything close to it would require roughly $5,000 in documented, traceable losses. Eligible losses and expenses must be fairly traceable to the Data Incident, or unreimbursed and incurred in or after 2024 and related to it, and the Notice lists them: unreimbursed losses relating to fraud or identity theft; professional fees including attorneys' fees, accountants' fees and credit repair fees; costs of freezing or unfreezing credit with a credit reporting agency; credit monitoring costs incurred on or after the Data Incident through the date of claim submission; miscellaneous expenses such as notary, fax, postage, copying, mileage and long-distance telephone charges; and other mitigative costs fairly traceable to the incident incurred in or after 2024 through the date of claim submission. A SECOND CAP SITS ON TOP OF THE $5,000, AND IT IS EASY TO MISS. The Notice provides that if the aggregate of all valid Out-of-Pocket Loss claims exceeds 50% of the Net Settlement Fund, each class member's loss payment is reduced pro rata so the total does not exceed that 50%. So an approved $5,000 loss claim is not guaranteed to be paid in full — it competes against every other loss claim for half the net fund. THE $485,000 IS THE DEFENDANT'S ENTIRE OBLIGATION, NOT A CLASS FUND. This is the number to anchor on. The Notice states the maximum total amount Defendant may be required to pay is $485,000.00, that this maximum includes the loss reimbursements, the cash payments, attorneys' fees, costs and expenses, service awards, and notice and administrative costs, and that “in no event shall Defendant's total financial obligation under the Settlement exceed $485,000.00.” Everything is paid out of that one capped amount. Lead Class Counsel will not seek more than one-third of the fund, $161,666.67, in attorneys' fees, plus up to $20,000 in litigation costs, and will request a Service Award of up to $5,000 for each Class Representative. Those requests, plus administration, come out before class money is divided — all subject to Court approval, and the Court may award less than requested. Spread across roughly 19,990 people, $485,000 is a small settlement. THERE IS NO CREDIT MONITORING BENEFIT, WHICH IS UNUSUAL FOR A DATA BREACH SETTLEMENT. This settlement does not provide a monitoring or identity protection product at all. What it does do is reimburse credit monitoring you paid for yourself on or after the Data Incident, as part of the Out-of-Pocket Losses benefit — which means it is capped inside the $5,000 and requires receipts. NOTHING IS PAID UNTIL THE COURT APPROVES. The Final Approval Hearing is set for January 13, 2027 at 9:00 a.m. before Judge Donald C. Nugent in the Northern District of Ohio. The Notice warns that no settlement benefits or payments will be provided unless the Court approves the Settlement and it becomes Final, and that approved claims will be paid after all appeals and other reviews, if any, are completed. Payment is by check unless electronic payment is chosen, and checks expire 180 days after issuance.

Last reviewed: October 7, 2026 | Information verified from court records and official settlement documents.

Frequently Asked Questions