University of Minnesota Data Breach Settlement: $5M

Individuals whose personal information was maintained in or accessible through the University of Minnesota's Legacy Data Warehouse as of Aug. 10, 2021.

This includes prospective students, current and former students, employees and program participants from 1989 through Aug. 10, 2021.

No documentation is required, but claimants must provide identifying information to confirm they are part of the settlement class.

A $5 million settlement has been reached with the University of Minnesota over a data breach that went undetected for more than two years before affected individuals were notified.

Current and former students, employees and applicants dating back to 1989 may be eligible for compensation.

With campuses in the Twin Cities, Duluth, Morris, Crookston and Rochester, the university serves more than 45,000 students and employs roughly 20,000 people. Its databases contain decades of records on anyone who has applied, enrolled, worked or participated in programs over that span.

Hackers accessed the university's Legacy Data Warehouse in August 2021, compromising a repository of sensitive personal information. However, the breach wasn't publicly disclosed until September 2023, leaving those affected in the dark for more than two years without any opportunity to protect themselves.

Compromised records included a wide range of sensitive details: names, Social Security numbers, dates of birth, driver's license numbers, contact information, demographic data, application materials, admission records, academic transcripts and employment information. For many people, this represented a comprehensive profile that could be exploited for identity theft.

Plaintiffs accused the university of failing to implement reasonable security measures and taking far too long to notify those whose information was exposed. Prompt disclosure, they argued, would have allowed affected individuals to monitor their credit, freeze accounts or take other protective steps before potential misuse occurred.

University officials have denied wrongdoing and have not admitted that security practices were inadequate. Rather than continue the litigation, both sides agreed to resolve the matter through this settlement.

How to Claim Your Payment

Class members who file a valid claim will receive a $30 cash payment. If the number of claims exceeds available funds after administrative costs and legal fees, payments may be reduced proportionally.

Beyond the cash payment, claimants can opt into 24 months of free dark web monitoring. This service scans underground websites and forums where stolen data is often bought and sold, alerting you if your personal information surfaces.

Eligibility spans more than three decades of university records. Anyone who applied to the University of Minnesota, attended any of its campuses, worked there in any capacity or participated in university programs between 1989 and August 2021 may have had information in the compromised database.

Filing a claim requires basic identifying information—your name, address, email and phone number—along with details establishing your connection to the university during the covered period. No receipts or other documentation is required.

Claims must be submitted by Dec. 24, 2025. Those who wish to opt out or object to the settlement must do so by Dec. 29, 2025. A final approval hearing is scheduled for Jan. 28, 2026.