Customers of Union Bank and Trust Co. have only days left to file claims in a nearly $2.4 million class action settlement tied to a 2023 cyberattack that exposed names, Social Security numbers, and other sensitive personal data. The deadline to submit a valid claim form is July 21, 2026.
The breach, which occurred over a five-day window from May 27 to May 31, 2023, compromised personally identifiable information stored in the bank's files. Plaintiffs in the resulting lawsuit alleged that Union Bank and Trust failed to implement reasonable cybersecurity measures, a charge the bank has denied while agreeing to settle.
For affected customers who have not yet acted, the clock is running out. And for anyone who has grown numb to the drumbeat of data breach headlines, the settlement terms here are worth a closer look, not because the total pot is enormous, but because the per-claimant payouts are structured to reward those who can document real harm.
The compensation breaks into three tiers, as detailed by The Sun. Class members who suffered ordinary out-of-pocket losses can claim up to $2,500 in reimbursement. That figure includes compensation for up to four hours of lost time spent dealing with the fallout, valued at $25 per hour.
A second tier covers extraordinary losses, expenses that were not otherwise reimbursed and that occurred between May 31, 2023, and the end of the claims period. That category allows claims of up to $10,000.
The headline figure of $12,500 reflects the combined maximum of both tiers, though the settlement materials do not explicitly state whether a single claimant can collect from both categories simultaneously. Customers who suffered no documented financial losses can still receive a flat cash payment of $100.
Every eligible class member also qualifies for two years of three-bureau credit monitoring and identity theft protection, a standard but meaningful benefit given the type of data exposed.
Union Bank and Trust Co. is a multi-state financial institution offering checking accounts, commercial loans, investment services, and financial planning. The bank serves customers across several states, though the settlement materials do not specify which ones or how many individuals were affected by the breach.
The bank has denied any wrongdoing as part of the settlement. That denial is standard boilerplate in class action resolutions, but it sits uneasily next to the core allegation: that a financial institution entrusted with Social Security numbers and other sensitive data did not take adequate steps to protect it.
The Union Bank and Trust settlement deadline arrives amid a broader wave of financial-sector data breach litigation that should concern every American with a bank account, brokerage, or insurance policy.
The pattern is by now depressingly familiar. A company collects vast quantities of personal data. A cyberattack exploits weaknesses in the company's defenses. Customers learn months later that their most sensitive information has been compromised. A class action follows. The company settles for a sum that barely registers on its balance sheet. And the affected individuals are left to spend hours filing paperwork for modest payouts while monitoring their credit for years.
Consider the scale of recent cases. Fidelity reached a $2.5 million settlement after hackers compromised data belonging to 77,000 customers. The dollar figures sound large in isolation, but divided across tens of thousands of claimants, individual recoveries shrink fast.
Several procedural milestones in the Union Bank and Trust case have already come and gone. The deadline to object to or exclude oneself from the settlement passed on June 26. That means the class is now locked in, no one can opt out to pursue independent litigation.
The final approval hearing is scheduled for August 6. If the court grants approval, the settlement administrator will begin processing claims and distributing payments. The remaining question is whether enough eligible class members will file before the July 21 cutoff to make meaningful use of the $2.4 million fund.
In many class action settlements, claim rates are strikingly low. Eligible individuals never learn about the case, lose track of deadlines, or simply decide the paperwork is not worth the effort. That dynamic often means the settling company pays out far less than the headline number, a convenient outcome for defendants, and a poor one for the people whose data was exposed.
What remains unknown about this case is telling. The settlement materials referenced in public reporting do not identify the court overseeing the litigation or the case docket number. The type of cyberattack, whether ransomware, phishing, a third-party vendor compromise, or something else, has not been disclosed. The number of affected class members has not been made public. And the plaintiffs' attorneys' fee arrangement is not detailed.
These gaps matter. Without knowing how many people were harmed, it is impossible to judge whether a $2.4 million settlement represents adequate accountability or a bargain-basement escape hatch for the bank. A settlement that compensates 500 people is a very different animal from one that covers 50,000.
Other recent bank data breach settlements offer a point of comparison. Flagstar Bank agreed to a $31.5 million settlement with per-claimant payouts of up to $599, a much larger total fund but a lower individual ceiling. The tradeoffs vary case by case, but the underlying failure is consistent: institutions that profit from collecting personal data are not bearing sufficient consequences when they fail to protect it.
The problem is not limited to banks. Comcast agreed to a $117.5 million settlement after a 2023 breach exposed millions of Xfinity customers. The numbers grow, the headlines repeat, and the incentive structure remains largely unchanged.
Anyone who held an account with Union Bank and Trust Co. during the May 27, 31, 2023, breach window should determine whether they received a notice of the settlement and whether they qualify as a class member. Eligible individuals must submit a valid claim form before July 21, 2026.
Those who can document out-of-pocket expenses, fraudulent charges, costs associated with credit freezes, time spent resolving identity theft issues, should gather that documentation before filing. The difference between a $100 flat payment and a claim approaching the $12,500 ceiling depends entirely on what a claimant can prove.
Financial institutions across the country continue to face similar lawsuits. First Financial Security's data breach settlement carries its own approaching deadline, a reminder that these cases arrive in waves and demand attention from anyone whose personal information sits in corporate databases, which is to say, nearly everyone.
Union Bank and Trust denied wrongdoing. The settlement fund, while not trivial, represents a fraction of what a multi-state bank generates in revenue. The two-year credit monitoring benefit is useful but finite. And the customers whose Social Security numbers were exposed will carry that risk for the rest of their lives, long after the monitoring expires and the settlement checks clear.
That is the fundamental imbalance in data breach litigation as it currently operates. Companies collect the data, profit from the relationships, suffer a cyberattack, deny fault, write a check, and move on. The customers absorb the lasting vulnerability.
Until the cost of failing to protect personal data exceeds the cost of investing in cybersecurity, settlements like this one will keep arriving, and Americans will keep scrambling to file claims before deadlines they barely heard about.