CFCU Data Breach Settlement: $2.9M

U.S. residents whose personal information was potentially compromised during the CFCU data breach that occurred between Dec. 31, 2023 and Jan. 11, 2024, including those who received a notification letter about the incident.

Claimants seeking reimbursement for out-of-pocket losses must provide documentation such as receipts, invoices or bank statements showing breach-related expenses.

Communication Federal Credit Union has agreed to pay $2.9 million to resolve a lawsuit stemming from a data breach that exposed sensitive member information over a two-week period spanning late 2023 and early 2024.

The settlement provides cash payments and identity protection services to those whose data may have been compromised.

CFCU is a member-owned financial institution serving communities in Oklahoma and Kansas. Between Dec. 31, 2023 and Jan. 11, 2024, an unauthorized party gained access to the credit union's systems and potentially viewed or obtained personal records belonging to members and other individuals.

The breach exposed a significant amount of sensitive data. According to court filings, the compromised information included names, dates of birth, home addresses, Social Security numbers, driver's license numbers, bank account details and payment card numbers—essentially everything someone would need to commit identity theft or financial fraud.

The lawsuit claimed CFCU failed to implement adequate security measures to protect this information. Plaintiffs argued that basic cybersecurity protocols could have prevented the intrusion or limited its scope, and that the credit union's negligence left members vulnerable to identity theft and fraud.

CFCU has denied these allegations and has not admitted any fault. The credit union agreed to the settlement to bring the matter to a close without further litigation.

Compensation Options for Class Members

The settlement offers different forms of relief depending on whether you suffered direct financial harm from the breach.

Members who incurred expenses dealing with the aftermath can claim up to $7,500 in reimbursement. Covered costs include fees for credit monitoring or credit reports, charges to replace identification documents, phone and postage expenses related to addressing the breach, and any unreimbursed losses from fraud or identity theft.

You'll need receipts, statements or other records showing what you spent.

Those who weren't hit with out-of-pocket costs can still receive a share of the settlement fund. After legal fees and administrative expenses are deducted, the remaining balance will be divided among all claimants in this category. Current estimates put the payment at around $125 per person, though the final amount will depend on participation levels.

Regardless of which payment option you choose, all class members who file a claim are entitled to three years of identity theft protection and credit monitoring at no cost. The package includes up to $1 million in identity theft insurance coverage.

The deadline to submit a claim is Dec. 22, 2025. A final approval hearing is set for Jan. 7, 2026.