Most of the people eligible for a new $5.5 million data-breach settlement have probably never heard of the company paying it. Doxim, Inc. is a behind-the-scenes vendor that prepares account statements and tax forms for credit unions, which means it holds sensitive financial details for members who never dealt with it directly. A December 2023 breach exposed that data, and the resulting settlement now offers a flat $100 payment with no proof of loss — but the claim window closes on October 13, 2026.
The case is a clear example of how personal financial information can be compromised through a company a consumer has no relationship with at all. For credit union members, particularly older ones who rely on mailed statements and printed tax documents, the settlement is worth understanding precisely because the exposure came from a name most would not recognize.
Why a Company Most People Never Heard Of Holds This Data
Doxim operates as a document and communications provider for financial institutions, generating the statements, notices, and tax forms that many credit unions send to their members. That role means the firm processes names, account information, and other financial identifiers on behalf of institutions its customers do business with. When Doxim suffered a data breach in December 2023, the exposed information belonged to members of those credit unions, according to the summary published by ClassAction.org.
The arrangement is common across the financial industry, where institutions outsource statement and tax-form printing to specialized vendors. It also means the trail of responsibility for a breach can run through a company a member never chose — and, as here, that vendor becomes the party funding the settlement.
Free retirement updates: A quiet rule change can shrink a Social Security or Medicare check, with no warning. The free Retirement Shield newsletter catches these early and explains what to do. Get it free by email.
What the Settlement Pays
The $5.5 million fund offers eligible claimants a choice. The simplest option is a flat payment of roughly $100 that requires no documentation of any harm. A claimant who instead documents out-of-pocket losses tied to the breach — fraudulent charges, fees, or the cost of recovering from identity theft — can seek reimbursement of up to $5,000. All eligible claimants are also offered a year of credit monitoring, a service that flags new accounts or inquiries in a person’s name.
As with many breach settlements, the flat no-proof payment is what makes filing accessible to people who saw no obvious fraud but were still part of the exposed group. Because the fund is fixed, the final per-person amount on the flat option can be adjusted up or down depending on how many valid claims come in. The credit monitoring included with a claim is a separate benefit worth noting on its own: it watches for new accounts opened in a person’s name, the same activity a stolen identity typically produces, and it runs whether or not a claimant ever sees a fraudulent charge.
The documented-loss track, capped at $5,000, is aimed at the narrower set of members who can tie an actual expense to the breach. Reconstructing those costs usually means gathering bank records, correspondence, or receipts, which is why most eligible members are expected to take the simpler flat payment rather than assemble a paper trail for a larger, uncertain reimbursement.
Filing by the October 13 Deadline
Claims go through the official court-appointed administrator, online or by mail, and no fee is required to take part. An online claim must be submitted by 11:59 p.m. Eastern time on October 13, 2026, and a mailed claim must be postmarked by that date. The administrator’s settlement website provides the claim form and the notice that explains who is covered; class members typically received a mailed or emailed notification identifying them as eligible.
One detail sets the timing of any payment apart from the claim deadline. A final approval hearing is scheduled for October 28, 2026, before Judge Terrence Berg in the U.S. District Court for the Eastern District of Michigan. Payments are not issued until the court grants final approval and any appeals are resolved, so filing on time secures a place in the settlement but does not produce an immediate check.
The Broader Lesson for Credit Union Members
The Doxim case illustrates a risk that is easy to overlook: a person can guard their own accounts carefully and still be exposed through a service provider they never selected. For retirees who bank with a credit union, the settlement is both a potential $100 and a prompt to treat the accompanying year of credit monitoring as useful in its own right. The clock is the binding constraint here — the claim period ends October 13, well before the court’s late-October hearing — and a claim not filed by then cannot be revived afterward.
This article was researched and drafted with the assistance of AI and reviewed by The Financial Wire editorial team.
More Financial Reading
- What really happens to your joint savings account when you die?
- Adding someone to your bank account: tax traps and smart moves
Warren Cohen is a finance writer based in Phoenix, Arizona, covering personal finance topics including credit, banking, and beginner investing. He earned his degree in business administration from Arizona State University and began his career working in consumer finance, where he gained direct experience with lending and credit systems. He now writes for personal finance websites and fintech platforms, focusing on clear, practical content that helps readers make informed financial decisions.
