A $5.5 million settlement over a data breach at Doxim, a technology vendor that prepares account statements and tax forms for credit unions, lets eligible class members claim a flat $100 with no documentation, with the filing window closing October 13. The breach dates to December 2023, when an intruder accessed a Doxim system holding customer information routed through the credit unions it serves. Because the company sat behind the scenes, many of the people whose data was exposed never dealt with Doxim directly and may not recognize the name on the settlement notice.
What the $5.5 million Doxim settlement covers
The settlement resolves a class-action lawsuit alleging that Doxim failed to adequately protect personal information tied to the December 2023 incident. The company denies wrongdoing, and the agreement is the negotiated resolution rather than a court finding of fault. The fund is meant to compensate people whose data was involved and to pay for the costs of administering the claims, notice, and any court-awarded fees.
Eligibility is the pivotal detail. The settlement covers people who were sent notice that their information was affected by the Doxim breach, not the general public, so the starting point is whether a person received a notice by mail or email. A write-up of the terms from the ClassAction.org report on the Doxim settlement spells out the class definition and the benefits available to those who qualify.
The connection for most affected people runs through their credit union rather than through Doxim itself. Doxim processes statements, tax documents, and related mailings on behalf of financial institutions, so the exposed records belonged to members of the credit unions that used its services in 2023. That indirect relationship is why the notice may name a company a person has never heard of, and why matching the notice to a familiar credit union is the surest way to confirm the tie.
Free retirement updates: Want plain-English help keeping more of your money in retirement? The free Retirement Shield newsletter covers the benefits, deadlines, and money mistakes that cost retirees, a couple times a week. Subscribe free.
The $100 no-proof option versus documented losses up to $5,000
Eligible class members choose between two paths. The simpler is a flat cash payment estimated at $100 that requires no proof of any loss, a common structure in data-breach settlements designed to compensate people for the exposure itself. The alternative is a claim for documented out-of-pocket losses of up to $5,000, which demands receipts and records tying real costs, such as fraud losses, bank fees, or the price of credit services, to the breach.
The settlement also offers a year of credit monitoring to eligible members who request it, a benefit separate from the cash payment. The estimated $100 figure can be adjusted up or down depending on how many valid claims come in and how much of the fund remains after documented claims and administrative costs are paid, so the final amount is not guaranteed to the dollar. A summary of the payment tiers and the monitoring benefit appears in the Dapeer open-settlements listing for the Doxim incident.
For most people the flat payment is the practical choice, because the documented-loss route asks for records that few kept. To recover more than the $100, a claimant generally has to attach proof such as bank or card statements, fraud reports, or receipts showing money spent as a result of the breach, and losses that cannot be tied to the incident do not count. Anyone weighing the larger claim has to judge whether the paperwork they can assemble is worth more than the certainty of the no-proof amount.
Who received notice and the October 13 filing deadline
Claims must be submitted online or postmarked by October 13, 2026, at 11:59 p.m. Eastern time, and a claim filed after that date will not be paid. Separate dates govern the other choices: class members who want to exclude themselves or object have an earlier cutoff of September 28, 2026, and the U.S. District Court for the Eastern District of Michigan has set a final-approval hearing for October 28, 2026. The payments do not go out until the settlement receives final approval and any appeals are resolved.
For older adults, the practical work is confirming eligibility rather than assuming it. Anyone unsure whether they were part of the breach can check for a mailed or emailed notice and match it against membership in a credit union that used Doxim’s statement services during 2023. Guarding against follow-on fraud matters as much as the payout, and the Federal Trade Commission’s steps to take after a data breach outline how to watch accounts and place a credit freeze. Doing nothing carries a quiet cost. A class member who neither files a claim nor opts out gives up the payment yet remains bound by the settlement’s release, meaning they lose the right to sue over the breach without receiving anything in return. That trade-off is what makes the short filing task worth doing for anyone who confirms eligibility. The money at stake is modest, but for a verified class member it is $100 available for a few minutes of filing, and the window shuts on October 13.
This article was researched and drafted with the assistance of artificial intelligence.
More Financial Reading
