Most consumers have never heard of Doxim, yet the company quietly handles sensitive financial paperwork for banks and credit unions across the country. That obscurity now sits at the center of a $5.5 million class-action settlement over a data breach that struck around December 30, 2023. Doxim prepares account statements and tax forms for credit-union clients, and the intrusion exposed the very records it was hired to safeguard. Members of the settlement class can pursue a payment of up to $5,000 or a flat cash option, but only by filing a valid claim before October 13, 2026.
How a Behind-the-Scenes Vendor Exposed Credit-Union Members
The consolidated case, titled In re Doxim, Inc. Data Security Incident Litigation, accused the third-party services provider of failing to put reasonable cybersecurity measures in place. Doxim works behind the scenes for financial institutions such as Beacon and Credit Union ONE, generating the statements and tax documents that members receive. When attackers breached its systems on or about December 30, 2023, the fallout reached people who had no direct relationship with the vendor and, in many cases, had never encountered its name.
Court records indicate the compromised files could have included names, addresses, financial account numbers, and Social Security numbers, according to a summary of the class action that describes the alleged failures. That mix of banking details and government identifiers is especially useful to fraudsters, because account numbers combined with a Social Security number can support both financial theft and impersonation.
Doxim has not admitted any wrongdoing, and the agreement resolves the claims without a court finding of liability. The settlement covers all living United States residents whom Doxim identified and to whom it, or its credit-union clients, sent notice that their information was affected by the December 2023 incident. For many members, the first sign of the breach was a letter arriving from a familiar credit union about a company they had never chosen to trust.
Free retirement updates: A quiet rule change can shrink your Social Security or Medicare check, and no one warns you. The free Retirement Shield newsletter catches these early and tells you what to do. Get it free.
A $100 Flat Payment or Proof of Actual Losses
The settlement offers class members two ways to seek money, and the paths differ sharply in effort. Those who can document out-of-pocket losses traceable to the breach, such as identity theft or fraud costs, may claim reimbursement of up to $5,000 by submitting supporting proof like receipts or bank statements. Members without that paperwork can instead choose an estimated $100 cash payment that requires no proof of loss.
Both figures come with a caveat. Because the fund is fixed at $5.5 million and payments are distributed on a shared basis, the actual cash amount each qualifying member receives may end up larger or smaller than $100, depending on how many valid claims arrive. Separately, all class members can request one year of credit monitoring that includes identity-theft insurance, a benefit aimed at the long tail of risk that follows any exposure of Social Security numbers.
Filing runs through the court-approved settlement website, where claimants log in with a unique ID and PIN from their mailed notice or download a printable form to return by mail. Details on the process and payment options appear on the official Doxim settlement website, which the settlement administrator operates. No payment is guaranteed to anyone who fails to submit a complete, timely claim.
Preliminary Approval, Final Hearing, and What Comes Next
The deal reached an early milestone on June 5, 2026, when the court granted preliminary approval and cleared the way for notices and claim filing to begin. That step allows the process to move forward, but it is not the last word. A judge still has to decide whether the terms are fair before any money is released.
The court has set a final approval hearing for October 28, 2026, roughly two weeks after the claim deadline. Compensation will begin flowing to class members only after that approval is granted and any appeals are resolved, a sequence that can stretch the timeline well beyond the filing date. Members who do nothing keep no benefit and, unless they formally excluded themselves, give up the right to sue Doxim over the claims the settlement covers.
The unique ID and PIN requirement adds a practical hurdle for members who tossed the mailed notice, a common fate for envelopes from an unfamiliar sender. Those who cannot locate their credentials can contact the administrator to have them reissued, though that step eats into the limited filing window. The same caution that applies to any settlement applies here: legitimate administrators never charge a fee to release benefits, and any message demanding payment or full banking passwords to process a Doxim claim should be treated as a scam rather than a genuine notice.
The Doxim matter reflects a broader shift in how personal data leaks. Increasingly, the weak link is not the bank a customer chose but a little-known contractor several steps removed, a pattern visible across a growing list of open class-action settlements. That distance is the unresolved tension at the heart of vendor breaches: the people bearing the exposure never selected the company that lost their information, and a modest settlement payment does little to undo years of heightened fraud risk.
This article was produced with AI assistance and reviewed against primary sources by The Money Overview editorial team.
More Financial Reading
