Fairmont FCU Data Breach Settlement: $1.78m, Claims Open

Fairmont Federal Credit Union has agreed to pay $1,783,857.64 to settle a class action over a 2023 data security incident that the credit union says potentially affected about 187,038 people. Claims are open now, and the deadline to file a claim, opt out, or object is December 18, 2026. But this settlement is not final yet: the court still has to approve it, a final approval hearing is scheduled for February 8, 2027, and no payment date has been announced. That means no money moves until the court approves and any appeals end.

What happened

Unauthorised actors accessed personal and health information through Fairmont Federal Credit Union’s IT systems between September 30 and October 18, 2023. The credit union learned of the incident on January 23, 2024, and concluded on or about August 17, 2025 that the affected files contained personal information. Individual notifications began on September 11, 2025. The settlement class is defined around the incident the company publicly disclosed on or about April 30, 2025.

The exposed information, as listed in the notices, included names, dates of birth, Social Security numbers, passport numbers, and driver’s license or state ID numbers, as well as financial, insurance, and medical information. A fuller list adds financial account and routing numbers, card numbers with security codes, PINs and expiration dates, IRS PIN numbers, treatment and diagnosis details, prescription information, provider names, health insurance policy and subscriber numbers, full access credentials, security questions and answers, and digital signatures. Not every data element was involved for every person.

The plaintiffs allege Fairmont Federal Credit Union failed to adequately protect the information it held, bringing claims of negligence, negligence per se, breach of implied contract, and breach of fiduciary duty. The credit union denies all of the allegations and any wrongdoing, and the court has not decided who is right. Fairmont has said, as quoted in SecurityWeek’s September 2025 report: “To date, FFCU is not aware of any incidents of identity theft or financial fraud as a result of the incident.” The case is Butler v. Fairmont Federal Credit Union, No. 1:25-cv-00094-JPB, in the U.S. District Court for the Northern District of West Virginia, before Judge John Preston Bailey. It was filed in September 2025, the parties reached the settlement after a mediation on April 24, 2026, the proposed settlement was filed on September 15, 2026, and the court entered an order on the motion seeking approval of notice to the class on September 22, 2026.

The case itself has already moved once. On March 12, 2026, Judge Bailey dismissed the plaintiffs’ unjust enrichment claim and let the rest of the case go forward. Related lawsuits later filed in the circuit courts of Marion County and Kanawha County, West Virginia, were consolidated into the federal case and are resolved by the same settlement.

Fairmont Federal Credit Union is headquartered in Fairmont, West Virginia, and operates nine regional branches in the state. The breach was disclosed to the attorneys general of California, Maine, Montana, and Massachusetts on September 11, 2025, and to the Texas attorney general on September 12, 2025. The sourced state counts are Texas 1,206, Montana 38, Maine 53, and Massachusetts 53. Those four states together account for under 1% of the class, so they are not a geographic breakdown of the whole case.

What you can claim

Every class member who files a valid claim can receive three years of one-bureau credit monitoring and identity restoration services, including identity theft insurance of up to $1 million. That monitoring is in addition to any monitoring already accepted from Fairmont after the breach. Activation codes are sent only after final approval and the end of any appeals.

On top of the monitoring, each claimant takes one cash path. The first path is documented losses: reimbursement of unreimbursed out-of-pocket losses up to $7,500 per person, for losses incurred between September 30, 2023 and December 18, 2026, each needing reasonable third-party documentation, since self-prepared documents alone are not enough. Attested time can be added to that path: $35 an hour for up to four hours, a maximum of $140, with a written attestation. The second path, instead of documented losses and attested time, is an alternative cash payment of up to $150 with no documentation, paid pro rata, so it can be lower than $150.

One figure needs a clear warning. ClaimDepot headlines this settlement as up to $7,640 plus credit monitoring. That $7,640 is the documented-loss maximum of $7,500 plus the attested-time maximum of $140 combined. It is not a single cash payment, and it is not available on top of the $150 alternative payment, which is an either-or alternative to that path.

After fees, costs, and service awards, the net fund pays benefits in a fixed order: documented losses first, then attested time, then credit monitoring, and finally the alternative cash payments, which split whatever remains equally among valid claimants up to the $150 cap. The final per-person cash amount will not be known until the claim period closes. Class counsel will ask for attorneys’ fees of up to $594,599.74 plus documented costs, and service awards of up to $5,000 for each class representative, up to $3,500 for each state-court plaintiff, and up to $1,000 for each tag-along plaintiff. Fairmont also agreed to cybersecurity enhancements, including training, for five years.

Read also: our DaVita settlement explainer covers a separate case and is not connected to this Fairmont settlement.

What the fund really means per person

The following figures are TechReview’s own calculations from the settlement figures above, not figures from the court or the administrator. The gross fund of $1,783,857.64 divided by about 187,038 people is $9.54 per person. After only the requested attorneys’ fees of $594,599.74, which is about 33.3% of the fund, the figure is $6.36 per person, and that is an upper bound, because administration costs, expenses, and service awards are not yet deducted. The $150 alternative cash cap is 15.7 times the $9.54 gross per-person figure, and the $7,500 documented-loss maximum is 786 times it. Paying $150 to every class member would need $28,055,700, about 15.7 times the whole fund, which is why the caps work only because they are capped, ordered, and paid pro rata.

The timeline carries its own point. The unauthorised-access window ran 19 days, from September 30 to October 18, 2023. Discovery came 115 days after that window started, on January 23, 2024. The scope conclusion took another 572 days, to August 17, 2025. From the start of the access window to the claim deadline is 1,175 days. The 572-day discovery-to-scope gap is the single most striking interval in this case, followed by a settlement filed roughly a year after individual notifications began.

How to file, and the deadlines

Claims are filed through the official settlement website, ffcudatasettlement.com, which Kroll Settlement Administration runs. The online claim form requires the Class Member ID printed on the court-authorised notice, and it will not continue without it. Anyone missing a notice should contact Kroll through the official settlement website. Kroll’s public phone number on the site is (833) 453-2784, and mailed claims go to Butler v. Fairmont Federal Credit Union, c/o Kroll Settlement Administration LLC, P.O. Box 225391, New York, NY 10150-5391.

Three deadlines share one date. Claims must be submitted online by 11:59 p.m. Eastern Time on December 18, 2026, or mailed with a postmark by that date. The same date is the deadline to opt out and to object. Class members who do nothing will not receive benefits and will give up the right to sue Fairmont over this incident. Opting out preserves the right to sue separately but forfeits any settlement benefits. Anyone who objects can still submit a claim.

What to watch next

The final approval hearing is scheduled for February 8, 2027 at 2:30 p.m. Eastern Time at the federal courthouse in Clarksburg, West Virginia, though the notice says the date and time may change. Payments and credit monitoring activation codes go out only after final approval and the end of any appeals, so no payment date can be stated now. Two other things would change this story: a statement from Fairmont giving the cause of the breach, which no source has established, and any future tier-1 coverage of the settlement.

Sources

Coverage trigger: a Times West Virginian headline on 26 October 2026 first surfaced this settlement in the incident watch; that article’s body was not read, and nothing from it is used as a fact above.