← All Open Settlements
Data Breach Financial

CUSO Financial Services Data Breach Settlement

Settlement Amount
Up to $599 cash + $5,000 losses
Claim Deadline
November 16, 2026
Total Fund
$1,750,000
File on the official site → cusocybersecurityincident.com

Opens the court-appointed administrator's site in a new tab.

  • ✓ Official court-appointed administrator: cusocybersecurityincident.com
  • ✓ Free to file. SuitAlert never collects your claim information and never asks for an SSN.
  • ✓ Verified against the court docket September 20, 2026
  • We don't collect claim information or sell leads to law firms. This site is paid for by ads.

The CUSO Financial Services Data Breach Settlement is a closed-list settlement, and that is the first thing to check. The Settlement Agreement defines the class as U.S. residents whose Private Information may have been compromised in the December 2023 to January 2024 cybersecurity incident and who received a Notice of Data Breach from CUSO on or about October 2024. The Settlement Agreement puts that group at approximately 76,251 individuals. CUSO Financial Services, L.P. is a broker-dealer that delivers investment services through credit unions across the country, so far more people have a connection to CUSO than are in this class — being a member or customer of a credit union CUSO serves does not qualify you. The practical gate matches the legal one: both the online portal and the paper form require the Claim Number and PIN printed on that October 2024 postcard. One warning about the settlement website itself: its FAQ page summarises the Nationwide Class as everyone whose data was stored in CUSO's systems and who was impacted, leaving out the notice requirement. The court-approved Notice and the Settlement Agreement both include it, and they control. Do not read the FAQ summary as an invitation to file. For people who are on the list, the benefits are genuinely cumulative, not a choice. This is unusual. The Settlement Agreement says the California statutory payment may be claimed "in addition to, or in the alternative to" a documented loss claim, and the residual cash payment may be claimed in addition to, or instead of, either. Credit monitoring is separate again. One claim form, tick every box you qualify for. But none of the headline numbers is a cap on the settlement as a whole: $5,000 caps only the documented-out-of-pocket tier, $100 caps only the California statutory payment, and $599 caps only the residual payment. They do not lend to one another. And $599 is a ceiling, not a promise. The residual payment is whatever is left of the $1,750,000 fund after credit monitoring, documented losses, California statutory payments, attorneys' fees, the service award and administration costs, divided among approved claims — the Notice states in terms that the amount received may be less than $599, and gives no estimate. One date trap: claims are due November 16, 2026, but the deadline to opt out or object is October 1, 2026, six weeks earlier.

Do I Qualify?

You may be eligible if:

There are two gates: getting into the claim form, and substantiating each tier. Getting in. This is a proof-required settlement even for the tiers that need no receipts, because Section II of the claim form is headed "Proof of Class Membership" and asks for the Claim Number and PIN printed on the postcard notice CUSO mailed in October 2024. The online portal opens with the same login screen. That is a real barrier, not a formality, and it is the mechanism that keeps the class to the roughly 76,251 people on CUSO's notification list. It is not absolute, though: a class member who no longer has the postcard can use the contact page on the official settlement website, email CUSOCybersecurityIncident@noticeadministrator.com, or call 866-356-5835 to ask the administrator to confirm their status and supply the credentials. Substantiating each tier. The requirements differ sharply. Two years of IDX credit monitoring and the residual cash payment of up to $599 need nothing beyond a completed, signed claim form — no receipts, no police report, no fraud affidavit, and no showing that you were harmed. Documented losses up to $5,000 require supporting documentation, itemised on the form with a description of the loss, the date, the amount and a description of the record you are attaching. The claim form's own examples are professional fees including attorneys' and accountants' fees and credit repair charges, costs of freezing or unfreezing credit with a reporting agency, credit monitoring costs incurred on or after December 19, 2023, and miscellaneous expenses such as bank fees, notary, fax, postage, copying, mileage and long-distance telephone charges. The form is explicit that handwritten or self-prepared documents alone are insufficient and will result in claim denial; a self-prepared note such as a handwritten receipt may add clarity to other submitted documentation but cannot be the sole basis for reimbursement. The California statutory payment of up to $100 requires documentation of residence in California on December 19, 2023 — the claim form gives utility bills, tax documents and pay stubs from December 2023 showing the claimant's name and California address as examples. Everything is signed under penalty of perjury in Section VII, and the administrator reviews every claim for completeness and plausibility. It may request additional information, and the Notice states that a claimant who does not provide it in a timely manner has the claim considered invalid and unpaid.

File your claim through the official settlement website at cusocybersecurityincident.com before November 16, 2026.

File on the official site → cusocybersecurityincident.com

Opens the court-appointed administrator's site in a new tab.

What Happened?

CUSO Financial Services, L.P. is a broker-dealer and investment services firm that delivers investment and insurance products to members through credit unions. It uses a third-party service to archive communications, as the Financial Industry Regulatory Authority requires.

According to the Settlement Agreement, CUSO became aware on January 19, 2024 of a cybersecurity incident involving that third-party service provider. Its investigation determined that an unauthorized individual had accessed a single CUSO employee's account on the third-party service between December 19, 2023 and January 19, 2024. The private information at stake is data that can identify an individual, and the pleadings name names, Social Security numbers and driver's license or state identification card numbers.

In October 2024, after completing its investigation, CUSO sent notice of the incident to the individuals whose information may have been compromised, and offered them complimentary Experian IdentityWorks credit monitoring for 12 or 24 months. That October 2024 mailing is what defines the settlement class, and the Settlement Agreement puts it at approximately 76,251 individuals.

The named plaintiff, Stan Sinitsa, first sued in California Superior Court for the County of San Diego. CUSO removed the case to the U.S. District Court for the Southern District of California. The parties then went through four mediation sessions: two early neutral evaluation conferences before a magistrate judge, and two private mediations before a retired judge. They reached a settlement on August 29, 2025, dismissed the federal case, and refiled in state court.

The case is now Stan Sinitsa v. CUSO Financial Services, L.P., Case No. VCU326251, in the California Superior Court for the County of Tulare. Class Counsel are Daniel Srourian of Srourian Law Firm, P.C. and Marc H. Edelson of Edelson Lechtzin LLP; CUSO is represented by Constangy, Brooks, Smith & Prophete, LLP. Analytics Consulting LLC is the settlement administrator.

The court granted preliminary approval, the administrator mailed postcard notices to the class list and launched the settlement website, and claims are open until November 16, 2026. The final approval hearing is set for February 18, 2027 at 8:30 a.m. at 221 S Mooney Blvd., Visalia, California. CUSO denies all material allegations, including any allegation of negligence, fault, wrongdoing or liability, and the court has made no determination on the merits. No final approval order has been entered and no payment date has been announced.

How to File Your Claim

  1. File online at cusocybersecurityincident.com using the Claim Number and PIN printed on the postcard notice CUSO mailed you — Section II of the claim form is headed "Proof of Class Membership" and asks for both. NO POSTCARD? Use the contact page on the official settlement website, email CUSOCybersecurityIncident@noticeadministrator.com, or call the administrator toll-free at 866-356-5835 to ask whether you are on the class list and to have your credentials supplied. PREFER PAPER? Download the claim form from the Important Case Documents page of the settlement website, complete and sign it, attach supporting documentation for any tier that needs it, and mail it to CUSO Data Settlement, c/o Analytics Consulting LLC, PO Box 2010, Chanhassen, MN 55317-2010, postmarked no later than November 16, 2026. TICK EVERY BOX YOU QUALIFY FOR, because this settlement is additive rather than a choice. Section III is the two years of IDX credit monitoring. Section IV is reimbursement of documented out-of-pocket losses up to $5,000, with records attached. Section V is the California statutory payment of up to $100, which needs documentation of California residence on December 19, 2023. Section VI is the residual cash payment of up to $599. You can claim all four on the same form. SIGN SECTION VII. Every claim form must be signed under penalty of perjury, and the administrator reviews claims for completeness and plausibility and may request more information — a claimant who does not supply it in time has the claim treated as invalid and unpaid. WATCH THE EARLIER DATE. Claims are due November 16, 2026, but requests for exclusion must be submitted or postmarked on or before October 1, 2026, and objections must be received by the court on or before October 1, 2026. An exclusion request must be in writing, identify the case by name and Case No. VCU326251, state your full name and current address, and carry your signature
  2. Visit the official claim form: https://cusocybersecurityincident.com/

How Much Will I Actually Get?

THE STRUCTURE IS CUMULATIVE, WHICH IS UNUSUAL FOR A DATA BREACH SETTLEMENT. Most settlements of this kind force a pick between a flat payment and a documented claim. This one does not. The Settlement Agreement, the Notice and the claim form all use the same formula: the California statutory payment may be taken "in addition to, or in the alternative to" a documented loss claim, and the residual cash payment may be taken in addition to, or instead of, either of those. Credit monitoring sits outside all of it. A California Subclass member with receipts can claim all four things on one form. FOUR BENEFITS, FOUR SEPARATE CEILINGS THAT DO NOT LEND TO EACH OTHER. (A) TWO YEARS OF IDX CREDIT MONITORING, open to every class member who submits a claim form. It covers three-bureau credit monitoring and alerts, CyberScan dark web monitoring, $1 million of reimbursement insurance, fully managed identity restoration, member advisory services and lost wallet assistance. It needs nothing but the claim form, and the claim form confirms that someone who already enrolled in the complimentary Experian IdentityWorks monitoring CUSO offered in October 2024 is still eligible for this separate two-year IDX coverage. (B) REIMBURSEMENT OF DOCUMENTED LOSSES, up to a maximum of $5,000. This is unreimbursed out-of-pocket cost that is fairly traceable to the incident: costs, expenses, losses or charges from identity theft or identity fraud, falsified tax returns or other misuse of your Private Information; costs incurred on or after December 19, 2023 for buying or extending credit monitoring or identity theft protection, or for accessing, freezing or unfreezing credit reports; and miscellaneous expenses such as bank fees, notary, fax, postage, copying, mileage and long-distance telephone charges. Supporting records are required. (C) CALIFORNIA STATUTORY CASH PAYMENT, up to $100, for California Subclass members only, on a claims-made basis, with documentation of California residence on December 19, 2023. (D) RESIDUAL CASH PAYMENT, up to $599, open to every class member with an approved claim if funds are available. THE $5,000 IS NOT A CAP ON THE SETTLEMENT AND NEITHER IS THE $599. Each ceiling belongs to its own tier. $6,000 of documented out-of-pocket expenses still recovers $5,000, even though the tiers add up to more, because the $599 belongs to the residual tier alone and cannot absorb an overflow from the loss tier. Equally, a class member with no receipts at all is not limited to nothing — the residual payment and the monitoring do not depend on having suffered any loss. THE $599 IS A CEILING, NOT A PROMISE, AND THIS IS THE MOST MISREAD FIGURE HERE. CUSO agreed to a non-reversionary cash fund of $1,750,000. The residual payment is calculated pro rata from what remains of that fund after credit monitoring, documented loss payments, California statutory payments, attorneys' fees, the service award and administrative costs, divided among approved claims. The Notice says in terms that the amount received will depend on the number of approved claims and may be less than $599, and it offers no estimate. For scale, and this is our own arithmetic from the disclosed figures rather than any settlement estimate: Class Counsel agreed to limit the fee request to one-third of the fund, about $583,333, and will separately seek litigation costs of up to $20,000, which leaves roughly $1,146,667 before administration expenses, the IDX monitoring, the service award and any documented loss and California payments are taken out. Divided by $599, that is fewer than about 1,900 full payments — against a class of roughly 76,251 people. Once more than about 2.5 percent of the class files an approved claim, there is no longer enough in the fund to pay everyone $599, and the real threshold is lower still because every other cost comes out first. IF THE FUND RUNS SHORT, PAYMENTS ARE REDUCED PRO RATA AND PAID IN A FIXED ORDER: (1) documented losses, (2) the California statutory payment, (3) the residual cash payment. The residual tier is last in line, so it absorbs the shortfall first. TWO THINGS YOU CANNOT CLAIM. Losses already reimbursed by a third party, and credit monitoring that was provided to you free, whether through CUSO's October 2024 Experian offer or through this settlement's own IDX coverage. FUND MECHANICS. The fund is non-reversionary, so nothing goes back to CUSO; the Settlement Agreement names the Privacy Rights Clearinghouse as the cy pres recipient for any balance. Attorneys' fees, litigation costs, the service award and administration expenses all come out of the same $1,750,000, which is why they directly reduce the residual payment. Anything the court declines to award stays in the fund. If the settlement is approved and becomes effective, the administrator makes payments within 45 days of the Effective Date; the Settlement Agreement notes appeals can delay that and no payment date has been announced

Last reviewed: September 20, 2026 | Information verified from court records and official settlement documents.

Related Settlements

On Q Financial Data Breach Settlement — $1,250,000 — 38 days left Carter Credit Union Data Breach Settlement — Amount varies — 60 days left Ernst & Young, Bank of America MOVEit Data Breach Settlement — $2,500,000 — 18 days left

Frequently Asked Questions

I bank with a credit union that uses CUSO. Am I in this settlement?
Almost certainly not, and this is the single biggest misunderstanding about this case. CUSO Financial Services, L.P. delivers investment services through credit unions all over the country, so a great many people have some connection to it. The class is far narrower. The Settlement Agreement defines it as U.S. residents whose Private Information may have been compromised in the December 2023 to January 2024 incident and who received a Notice of Data Breach by CUSO on or about October 2024 — approximately 76,251 individuals. The incident itself was narrow too: an unauthorized individual accessed one CUSO employee's account on a third-party communications-archiving service. Your credit union membership is not the test; CUSO's October 2024 mailing list is. The claim form enforces it, because Section II asks for the Claim Number and PIN printed on that postcard. If you think you were notified but cannot find the postcard, call the administrator on 866-356-5835 or email CUSOCybersecurityIncident@noticeadministrator.com and ask them to check the class list.
The settlement website's FAQ describes the class without mentioning a notice. Which version is right?
The Notice and the Settlement Agreement are right, and they both require the October 2024 notice. The administrator's FAQ page summarises the Nationwide Class as "all persons whose personal identification information and data was stored in CUSO's systems at the time of the cybersecurity incident ... and who were impacted," which leaves the notice requirement out. The court-approved Notice of Proposed Class Action Settlement states that you are a Settlement Class member if you are a U.S. resident whose Private Information was stored in an affected account subject to the incident and who received a Notice of the Cybersecurity Incident from CUSO on or about October 2024, and the Settlement Agreement's own definition says the same. Those are the controlling documents and a summary on a web page does not amend them. Anyone relying on the shorter FAQ wording to conclude they qualify should check whether CUSO actually wrote to them in October 2024.
Do I have to choose between the $599, the California $100 and documented losses?
No, and that makes this settlement unusual. Most data breach settlements make you pick between a flat payment and a documented claim. Here the Settlement Agreement, the Notice and the claim form all say the California statutory payment of up to $100 may be claimed "in addition to, or in the alternative to" a documented loss claim, and that the residual cash payment of up to $599 may be claimed in addition to, or instead of, either of those. The two years of IDX credit monitoring is separate again and open to every class member who files. So a California Subclass member with receipts can tick all four sections of the same claim form. One caveat on ordering: if approved claims exceed the money left in the fund, payments are reduced pro rata and paid in a fixed sequence — documented losses first, then the California statutory payment, then the residual payment.
Does the $5,000 figure mean I can claim $5,000 of anything?
No. $5,000 is the ceiling on one tier only: reimbursement of documented, unreimbursed out-of-pocket costs fairly traceable to the incident. It is not a cap on the settlement, and it does not stretch to cover the other tiers. Each ceiling belongs to its own tier and none of them lends to another: $5,000 for documented losses, $100 for the California statutory payment, $599 for the residual cash payment. If you have $6,000 of documented out-of-pocket expenses you recover $5,000, and the $599 residual ceiling cannot absorb the extra $1,000 because it belongs to a different tier. The reverse also holds: a class member with no receipts at all is not shut out, because the residual payment and the credit monitoring do not depend on having lost anything.
Will I actually receive $599?
$599 is a ceiling, not a promise, and the Notice says so in terms — the amount received will depend on the number of approved claims and may be less than $599. The residual payment is calculated pro rata from whatever is left of the $1,750,000 fund after credit monitoring, documented loss payments, California statutory payments, attorneys' fees, the service award and administrative costs. No official estimate is available until claims are counted. To give a sense of scale, using only the disclosed figures and not any settlement estimate: Class Counsel agreed to limit the fee request to one-third of the fund, roughly $583,333, and will separately seek litigation costs of up to $20,000, leaving about $1,146,667 before administration expenses, the IDX monitoring, the service award and any documented loss and California payments come out. That is fewer than about 1,900 payments at the full $599, against a class of roughly 76,251 people. So once more than about 2.5 percent of the class files an approved claim the full amount cannot be paid to everyone, and the true threshold is lower because every other cost is deducted first. The residual tier is also last in the payment order, so it absorbs any shortfall before the other tiers do.
I already took the free Experian monitoring CUSO offered in 2024. Am I still eligible for anything?
Yes. The claim form states that a class member who enrolled in the complimentary Experian IdentityWorks monitoring CUSO offered in October 2024 is still eligible to receive the separate two years of IDX credit monitoring under this settlement, and that enrolment does not affect any cash tier. There is one restriction, and it sits in the documented loss section: you cannot claim reimbursement for credit monitoring services that were already provided to you at no cost, whether through the October 2024 Experian offer or through this settlement's own IDX coverage. The same rule bars claiming any loss that a third party has already reimbursed.
How do I prove I am in the California Subclass?
With documentation of residence in California on December 19, 2023, the first day of the incident window. The claim form gives utility bills, tax documents and pay stubs from December 2023 showing the claimant's name and California address as examples. The date that matters is December 19, 2023, not today, so a class member who was a California resident then but has moved since is still in the subclass and can still claim the statutory payment of up to $100. Conversely, someone who moved to California after the incident is not in the subclass, though they remain in the Nationwide Class and can still claim the monitoring, documented losses and the residual payment.
What are the deadlines, and why is one of them so much earlier?
Three dates matter. October 1, 2026 is the deadline both to exclude yourself and to object: a request for exclusion must be submitted or postmarked on or before that date, must be in writing, must identify the case by name and Case No. VCU326251, must state your full name and current address and must carry your signature; an objection must be received by that date. November 16, 2026 is the claim deadline — six weeks later — and a claim form must be submitted online or postmarked by then, with the Notice and claim form giving the date without a cut-off time or timezone. February 18, 2027 at 8:30 a.m. is the final approval hearing, at 221 S Mooney Blvd., Visalia, California. The gap catches people out: by the time many class members get round to filing a claim, the chance to opt out or object has already gone. You can object and still file a claim; opting out means you get nothing from the settlement but keep the right to sue on your own.
Do attorneys' fees reduce what I get?
Yes, and unlike some data breach settlements that is worth understanding here. There is a single common fund of $1,750,000 and everything comes out of it: the fee award, litigation costs, the service award to the class representative, administration expenses and the class benefits. Class Counsel agreed, with no consideration from CUSO, to limit their request for attorneys' fees to one-third of the fund, and will separately seek litigation costs not to exceed $20,000. Because the residual cash payment is calculated from what is left over, every one of those deductions directly lowers it. Anything the court declines to award stays in the fund and goes to class members instead. The fund is non-reversionary, so nothing returns to CUSO; the Settlement Agreement names the Privacy Rights Clearinghouse as the cy pres recipient for any remaining balance.
When would payment arrive?
No payment date has been announced. Payments depend on the court granting final approval at the February 18, 2027 hearing and on the settlement becoming effective, which under the Settlement Agreement is one business day after appeal deadlines pass or after any appeals are finally resolved. Once that happens, the Settlement Administrator must make settlement payments to class members with approved claims within 45 days of the Effective Date. The Settlement Agreement notes that appeals, if filed, add to that timeline. In the meantime, keep your address current with the administrator: you can update it on the claim form, or afterwards by emailing CUSOCybersecurityIncident@noticeadministrator.com with your name, claim number, old address and new address, or by writing to CUSO Cybersecurity Incident Settlement, c/o Claims Administrator, PO Box 2010, Chanhassen, MN 55317-2010.

New settlements, once a week. Deadlines only — no filler.