Pillsbury Law Firm Data Breach Settlement

Law firm breach: only if notified. First, the obvious confusion: this is the law firm, not the food brand. Pillsbury Winthrop Shaw Pittman LLP is an international law firm; Pillsbury refrigerated dough, flour and the Doughboy are General Mills brands and have nothing to do with this case. People notified of the April 2025 breach may claim. The settlement resolves Allison Archer v. Pillsbury Winthrop Shaw Pittman LLP, Case No. CACE-26-011734, in the Circuit Court for Broward County, Florida, over an April 2025 cyberattack in which the firm was one of many targeted by social engineering attempts and some files containing private information were accessed. Second, and unusually, the benefits stack rather than compete. Most data breach settlements make you pick between a flat payment and documented losses. This one does not: the Settlement Agreement says the Pro Rata Cash Payment may be claimed “in addition to any Cash Payment for Documented Losses,” and the Claim Form gives each a separate checkbox. You can claim a pro rata share of the $2,340,000 fund with nothing to document, plus up to $3,000 in documented out-of-pocket losses, plus one year of medical data monitoring that arrives automatically. Third, the real gate is the notice, not the name. The class is limited to living individuals residing in the United States who were provided notice that their information may have been accessed — Pillsbury identified class members from its own records, and the settlement documents never say how many people that is. If no notice reached you, you are very likely not a class member. Fourth, the $3,000 caps one benefit and is capped again. It applies per person to documented losses only, and all documented-loss payments together are limited to $1,500,000 across the class, cut pro rata if valid claims exceed that. The pro rata cash is unaffected by either ceiling, because Pillsbury pays documented losses separately from the $2,340,000 fund. No per-person estimate has been published for the pro rata payment, and it cannot be calculated from the documents — it depends on claim volume, and fees of up to one third are measured against a “Settlement Value” larger than the fund itself. Two practical notes: every deadline is December 7, 2026, claims, opt-outs and objections alike, and while the online portal needs the Login ID and PIN from your notice, the printable form asks for it only “if known”, so a lost notice is not a dead end.

Do I Qualify?

You may be eligible if:

• You were provided notice that your Private Information may have been accessed in connection with the April 2025 Pillsbury Winthrop Shaw Pittman data incident. That is the class definition, and the notice is the gate — Pillsbury identified class members from its own records
• In practice, a notice reached you. Notification emails went out October 2, 2026, and many class members also got a direct breach notice from Pillsbury earlier. If you think you are included but never saw one, Simpluris will check for free: (844) 496-1265 toll free, 24/7, or info@PillsburyDataSettlement.com
• IT IS THE LAW FIRM, NOT THE FOOD BRAND. Pillsbury Winthrop Shaw Pittman LLP is an international law firm. Pillsbury refrigerated dough, flour, cake mix and the Pillsbury Doughboy are General Mills consumer brands and have nothing to do with this settlement. Buying Pillsbury groceries does not qualify you
• You are a living individual residing in the United States. Both conditions are written into the class definition, so the estate of a class member who has died is not covered by its terms
• Any US state. Benefits do not vary by state, and neither Florida nor New York residence matters even though the case is in Broward County, Florida and earlier suits were filed in the Southern District of New York
• You do NOT need to have lost any money, and you do NOT need receipts, to claim the Pro Rata Cash Payment. The Settlement Agreement says claims for it do not require the submission of supporting documentation
• You do NOT have to pick between the benefits. The pro rata cash may be claimed in addition to a documented-loss payment, and the medical data monitoring arrives automatically on top of both
• You are not in an excluded group. The exclusions are partners, directors, officers and agents of Pillsbury; governmental entities; the assigned Judge, that Judge’s immediate family and Court staff; and anyone who opts out
• For the documented-loss benefit only, you have third-party records of out-of-pocket losses caused by the incident between April 29, 2025 and December 7, 2026 that were not reimbursed by anyone else
• You file one Claim Form by December 7, 2026 — online or by email by that date, or mailed with a postmark no later than that date. The opt-out and objection deadlines are the same day

WHAT YOU NEED DEPENDS ENTIRELY ON WHICH BENEFIT YOU WANT, AND FOR THE EASY ONE THE ANSWER IS NOTHING. The Pro Rata Cash Payment requires no documentation whatsoever. The Settlement Agreement states that claims for it “do not require the submission of supporting documentation,” and the Claim Form is a single checkbox in Section III. You do not have to show a loss, explain anything, or produce a receipt. The medical data monitoring requires nothing either, because there is nothing to claim — the agreement says all class members receive it automatically, and enrollment codes were already sent by postcard and/or email. Only the up-to-$3,000 documented-loss benefit calls for records. The one gate that applies to everyone is the online portal’s Login ID and PIN — and there is a documented way around it. The online claim form opens only with the LoginID and PIN printed on the notice, and the settlement website tells anyone who cannot find them to contact the administrator. But the printable Claim Form asks for the “Login ID (if known)” and can be mailed or emailed, so a class member without the notice is not locked out: complete the printed form and submit it that way, or call Simpluris at (844) 496-1265 toll free, 24/7, or email info@PillsburyDataSettlement.com and ask for a paper form and your details. Worth knowing, because in many data breach settlements the notice code gates the paper route too. What counts as documentation for the loss claim. The Settlement Agreement requires reasonable documented losses related to fraud and/or identity theft that are demonstrably a direct result of the Data Incident, supported by documentation submitted with the Claim Form. Send third-party records — bank statements and receipts are the examples the notice gives. The agreement is explicit that personal certifications, declarations or affidavits from the class member, standing alone, are not proper documentation, though they may be included to provide clarification, context or support for other reasonable supporting documentation. What the loss claim will not cover. Losses must have been incurred between April 29, 2025 and December 7, 2026. Nothing can be claimed that has already been reimbursed from another source, which the agreement spells out as including compensation from any credit monitoring or identity theft protection product and from a financial institution’s consumer fraud policies. And here is why trying the loss claim costs you very little. The Settlement Agreement provides that if a documented-loss claim arrives without sufficient supporting documentation, or the alleged loss is not directly related to the Data Incident, or the administrator rejects it for any reason and the class member fails to timely cure the deficiency, the claim is rejected for reimbursement but “shall be treated as a claim for Pro Rata Cash Payment” and processed accordingly. Unlike settlements where thin paperwork means walking away with nothing, a failed documented-loss claim here converts into the benefit you could have had for free. Tick both boxes anyway if you have any losses at all. Each person may submit only one Claim Form, signed under penalty of perjury.

What Happened?

Pillsbury Winthrop Shaw Pittman LLP is an international law firm. In the course of its practice it holds private information belonging to individuals. It is unrelated to the Pillsbury consumer food brands owned by General Mills, which are not involved in this case in any way.

According to the Settlement Agreement, in April 2025 Pillsbury was one of many law firms targeted by sophisticated social engineering attempts. The agreement defines the “Data Incident” as the cybersecurity incident resulting in unauthorized access to or acquisition of Settlement Class Members’ Private Information in April 2025. Some files containing private information were accessed. The settlement documents describe the incident only as occurring in April 2025 and do not give an exact date range, and they do not state how many people were notified.

The notice lists the information that may have been involved as names, dates of birth, addresses, Social Security numbers, drivers’ license numbers or other government-issued identification numbers, medical information, health insurance information and financial account information. Not every class member’s files contained every category.

The settlement resolves Allison Archer v. Pillsbury Winthrop Shaw Pittman LLP, Case No. CACE-26-011734, in the Circuit Court for Broward County, Florida. The Class Representatives are Allison Archer, Martin Chaveria-Hernandez and Frederico Reyes. Related proposed class actions had earlier been filed in the U.S. District Court for the Southern District of New York; the settlement was reached in the Florida state court case and covers everyone in the United States who was notified.

The Court appointed Jeff Ostrow of Kopelowitz Ostrow P.A. and Mariya Weekes of Milberg PLLC as Class Counsel. Class members are not charged for their services. Pillsbury is represented by Alfred J. Saikali of Shook, Hardy & Bacon L.L.P.

Pillsbury denies any wrongdoing, and the Court has not decided who is right. The parties agreed to settle to avoid the costs, risks and uncertainties of continuing to litigate.

The structure has two separate sources of money. Pillsbury funds a Settlement Fund of $2,340,000, out of which administration costs, Court-approved attorneys’ fees and costs and service awards are paid, with the remainder divided equally among those who claim the Pro Rata Cash Payment. Separately, the agreement provides that Pillsbury shall pay a maximum of $1,500,000 in aggregate for all valid documented-loss claims. Class Counsel will seek up to one-third of the Settlement Value, which the agreement defines to include both the fund and the money available for documented losses, plus service awards of $2,500 for each Class Representative, both payable from the Settlement Fund. If the settlement does not receive Final Approval, funds remaining in the Settlement Fund return to Pillsbury after outstanding administration costs are paid. Simpluris is the Settlement Administrator.

The Final Approval Hearing is scheduled for December 22, 2026 at 8:45 a.m. Eastern Time in Room #16-150 of the Circuit Court for Broward County, Florida, 201 SE 6th Street, Fort Lauderdale, with a Zoom option. The notice warns the date and time may change without further notice, and advises checking the settlement website. Benefits are distributed only if the Court grants Final Approval and after any appeals are resolved. No payment date has been announced.

How to File Your Claim

1. FILE AT PILLSBURYDATASETTLEMENT.COM — the official settlement website, administered by Simpluris. Use the Submit a Claim link for the online portal, or download the printable Claim Form from the site
2. CHECK BOTH BENEFIT BOXES IF BOTH APPLY TO YOU. The Claim Form has a separate Section II for Cash Payment for Documented Losses and a separate Section III for the Pro Rata Cash Payment, each with its own checkbox. They are not rival options on the form and ticking the pro rata box does not forfeit anything. Most people will tick Section III at minimum, because it asks for nothing but the box
3. THE ONLINE PORTAL NEEDS THE LOGIN ID AND PIN — BUT THE PAPER FORM DOES NOT. The online claim form opens only with the LoginID and PIN printed on your notice. The printable Claim Form, by contrast, asks for the “Login ID (if known),” so a class member who lost or never received the notice can still complete the printed form and submit it. That is a meaningful difference from many data breach settlements, where the code gates every route. You can also ask the administrator for your enrollment and login details, or for a paper Claim Form, by phone or email
4. THE PRINTED FORM CAN BE EMAILED OR MAILED. Mail it to Pillsbury Data Incident Settlement, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799-9958, or contact the administrator at info@PillsburyDataSettlement.com or (844) 496-1265 toll free
5. EVERY DEADLINE IS DECEMBER 7, 2026. Claims submitted online or by email are due that day, and a mailed Claim Form must be postmarked no later than that day. The notice does not specify a time of day or time zone for the online deadline. Unusually, this settlement puts the claim, opt-out and objection deadlines all on the same date, so there is no earlier trap date to miss — but there is also no grace period after the claim date to reconsider staying in the class
6. DO NOT FILE FOR THE MEDICAL DATA MONITORING — IT IS AUTOMATIC. The Settlement Agreement states that all Settlement Class Members will automatically receive the one year of CyEx Medical Shield Complete, and the notice says enrollment codes were already sent by postcard and/or email. There is nothing to claim. If you cannot find your enrollment code, the settlement website has an Enrollment Instruction Request page, or contact the administrator
7. IF YOU CLAIM DOCUMENTED LOSSES, ATTACH THIRD-PARTY RECORDS. Send bank statements, receipts or similar proof. Your own notes may be included to add context but, standing alone, are not enough
8. PICK HOW YOU WANT TO BE PAID. The Claim Form offers PayPal, Venmo, Zelle, a virtual prepaid card or a paper check. Give an email address and phone number you actually use, since the digital payment options and the monitoring enrollment both depend on reaching you
9. ONE CLAIM FORM PER PERSON, signed under penalty of perjury
10. QUESTIONS: Simpluris at (844) 496-1265 toll free, 24/7, or info@PillsburyDataSettlement.com
11. Visit the official claim form: https://www.pillsburydatasettlement.com/

How Much Will I Actually Get?

THE BENEFITS STACK — THIS IS NOT AN EITHER-OR SETTLEMENT. This is the single most important thing to understand here, because it is the opposite of how most data breach settlements are built. The Settlement Agreement states that “in addition to any Cash Payment for Documented Losses, all Settlement Class Members may elect to receive a Pro Rata Cash Payment,” and that “in addition to a Cash Payment, all Settlement Class Members will automatically receive” the medical data monitoring. There is no “in lieu of” clause anywhere. A class member with documented losses can collect reimbursement of those losses, plus the pro rata cash, plus the monitoring. The Claim Form confirms it with two independent checkboxes, one per cash benefit. THE PRO RATA CASH PAYMENT: AN EQUAL SHARE OF WHAT IS LEFT, WITH NOTHING TO PROVE. Pillsbury is funding a Settlement Fund of $2,340,000. Settlement administration costs, Court-approved attorneys’ fees and costs, and any service awards come out of that fund first; whatever remains is divided equally among everyone who files a valid claim for the pro rata payment. This benefit asks for no documentation and no explanation of any kind. NOBODY KNOWS WHAT THE PRO RATA SHARE WILL BE, AND THAT IS NOT A DETAIL. No per-person estimate has been published, and the amount cannot be estimated from the documents: it depends on how many people claim, and the settlement documents never state how many people were notified. Class Counsel will ask the Court for up to one-third of the Settlement Value in fees and costs — and the agreement defines Settlement Value to include both the $2,340,000 fund and the money available for documented losses, so the fee request is measured against a larger number than the fund the pro rata payment is actually drawn from. Service awards of $2,500 for each of the three Class Representatives also come out of the fund. Treat any specific dollar figure you see quoted for this payment as invented. THE $3,000 IS A CAP ON ONE BENEFIT ONLY — AND THAT BENEFIT CARRIES A SECOND, SEPARATE CAP. The $3,000 ceiling applies per class member to documented out-of-pocket losses, and to nothing else. It is not a cap on the settlement, not a cap on the pro rata payment, and not an amount anyone is promised. Reimbursable losses must have been incurred between April 29, 2025 and December 7, 2026 and must be a direct result of the Data Incident; the notice lists losses from identity theft or fraud, fees for credit reports, credit monitoring or freezing and unfreezing credit, the cost of replacing government-issued ID cards, and postage to contact banks by mail. Anything already reimbursed from another source — including from a credit monitoring product or a bank’s fraud policy — cannot be claimed. On top of the per-person $3,000, there is an aggregate cap of $1,500,000 on this benefit across the whole class, and the agreement provides that if valid documented-loss claims exceed that total, every documented-loss payment is cut pro rata to fit inside it. So a documented-loss claim can be trimmed twice over: once by the $3,000 per-person ceiling and again by the $1,500,000 class-wide ceiling. THE TWO POTS ARE SEPARATE, AND THAT HELPS CLAIMANTS. The Settlement Agreement says “Defendant shall pay a maximum of $1,500,000.00 in aggregate for all Valid Claims for Cash Payments for Documented Losses” — Pillsbury pays those claims, and they are not drawn from the $2,340,000 Settlement Fund, which is defined separately as the cash Pillsbury funds for the rest of the settlement. The practical consequence is that documented-loss claims filed by other people do not shrink your pro rata share, and your own documented-loss claim does not reduce your pro rata share either. A REJECTED DOCUMENTED-LOSS CLAIM FALLS BACK TO THE PRO RATA PAYMENT. This is a genuinely favorable term that many settlements lack. The Settlement Agreement provides that if a documented-loss claim comes in without sufficient supporting documentation, or the loss is not directly related to the Data Incident, or the administrator rejects it for any reason and the class member does not timely cure the deficiency, then “the Claim shall be treated as a claim for Pro Rata Cash Payment” and processed accordingly. Attempting the documented-loss route is therefore low-risk — a failed attempt lands you where you would have been anyway, rather than leaving you with nothing. MEDICAL DATA MONITORING COMES FREE AND AUTOMATICALLY. Every class member gets one year of CyEx Medical Shield Complete, which carries $1,000,000 of medical identity theft insurance and monitors for healthcare insurance identification number exposure, medical record number exposure and unauthorized health savings account spending, with access to a fraud resolution agent. Enrollment codes were already sent by postcard and/or email, and the agreement says the codes are activated when cash payments are distributed. Note what the $1,000,000 figure is: an insurance coverage limit inside a monitoring product that you would have to suffer a covered loss to draw on. It is not money being distributed to the class, and it should not be added to the settlement’s value in your head. NOTHING IS PAID UNTIL THE COURT APPROVES. The Final Approval Hearing is set for December 22, 2026 at 8:45 a.m. Eastern Time in Room #16-150 of the Circuit Court for Broward County, Florida, 201 SE 6th Street, Fort Lauderdale, and may also be attended by Zoom. The notice warns the date and time may change without further notice. Payments are distributed only if the Court grants Final Approval and after any appeals are resolved, and no payment date has been announced.

Last reviewed: October 8, 2026 | Information verified from court records and official settlement documents.

Frequently Asked Questions