A data breach at a behind-the-scenes financial software vendor has produced a $5.5 million settlement, and the people whose personal information was exposed have until October 13, 2026, to claim a cash payment. Many of those affected are credit union members who never dealt with the company directly and may not realize their names, account numbers, and Social Security numbers were involved. For anyone who received a breach notice, the claim is straightforward and the clock is the only real obstacle.
What the Doxim settlement pays
The settlement resolves claims over a data incident that occurred around December 30, 2023, when an unauthorized actor gained access to files held by Doxim, Inc., a vendor that prepares account statements and tax forms for credit unions. According to the official settlement administrator’s frequently asked questions page, the compromised information may have included names, addresses, financial account numbers, and Social Security numbers. Doxim and the co-defendant credit unions deny any wrongdoing, and the court has not found that any law was broken; the parties agreed to settle to avoid the risk and expense of continued litigation.
Class members have two cash paths. Someone who does not want to gather paperwork can request an alternate cash payment estimated at $100 with no documentation required. Anyone who suffered out-of-pocket losses that can be reasonably traced to the breach, such as fraud or identity-theft costs, may instead submit documentation and claim up to $5,000. Either option can be paired with one free year of credit monitoring. Because the payouts are pro rata, the final amount can move up or down depending on how many valid claims are filed against the net fund.
Free retirement updates: Enrollment and claim windows come and go, and missing one can cost you real money. The free Retirement Shield newsletter keeps you ahead of the deadlines that matter. Sign up free.
Who is eligible and the October 13 deadline
Eligibility is narrow and specific: the settlement class covers living U.S. residents who were identified by Doxim and sent a notice that their private information was affected by the December 2023 incident. Those who received such a notice are the ones who can file. The administrator allows class members to submit online or by mail, and claim forms and the full settlement documents are posted on the settlement’s documents page for anyone who wants to read the underlying agreement before deciding.
The deadline leaves little room for delay. A claim form must be submitted online by 11:59 p.m. Eastern time on October 13, 2026, or mailed and postmarked by the same date. A separate, earlier deadline of September 28, 2026, applies to anyone who wants to exclude themselves from the settlement or object to it, and the court has set a final approval hearing for October 28, 2026. Payments are not distributed until after the settlement is approved and becomes final.
The choice between the two cash options comes down to paperwork and circumstances. Someone who simply wants a share of the fund without hunting for documents can take the flat alternate payment, while anyone who spent money resolving fraud, freezing accounts, or replacing compromised information after the breach may recover more by documenting those costs up to the $5,000 ceiling. Under the terms, a claim submitted for documented losses that lacks adequate proof is not thrown out; it is processed as the alternate cash claim instead, so filing carries little downside. Every valid claim can also add the year of credit monitoring, which has standalone value for anyone whose Social Security number was exposed.
Why older account holders should check their mail
The people most likely to miss this settlement are precisely those it is meant to help. Because Doxim works in the background for credit unions, an affected member’s only warning was a mailed or emailed notice that can easily be mistaken for junk. The official settlement site is the authoritative place to confirm eligibility, and it is the only site that should be used to file, since fraudsters routinely spin up look-alike pages after a breach settlement is announced.
For an older household, the exposure here is more than a one-time payout. Leaked Social Security numbers and account details can fuel identity theft for years, which is why the free year of credit monitoring bundled with a claim is worth as much as the cash for many people. A breach of statement and tax-form data is particularly sensitive because those documents tie a name and address to specific account numbers, the exact ingredients a thief needs to attempt new-account fraud or file a fraudulent tax return. Anyone who received a Doxim notice may want to pair the settlement’s monitoring with a credit freeze at the three nationwide bureaus, a separate free step that blocks new accounts regardless of this case.
Filing takes only a few minutes, requires no documentation for the $100 option, and closes off a small piece of the risk that a breach like this leaves behind. The one thing a class member cannot recover is the deadline itself once October 13 passes.
This article was researched and drafted with the assistance of AI and reviewed by The Financial Wire editorial team.
More Financial Reading
- Bank statements: how long to keep them and when to toss them
- What really happens to your joint savings account when you die?
Warren Cohen is a finance writer based in Phoenix, Arizona, covering personal finance topics including credit, banking, and beginner investing. He earned his degree in business administration from Arizona State University and began his career working in consumer finance, where he gained direct experience with lending and credit systems. He now writes for personal finance websites and fintech platforms, focusing on clear, practical content that helps readers make informed financial decisions.
