People notified of the Doxim data breach can claim a flat $100 with no receipts, or up to $5,000 if they can document losses, but the claim window shuts October 13, 2026. The money comes from a $5.5 million settlement over a December 2023 breach at Doxim, a behind-the-scenes vendor that prepares account statements and tax forms for credit unions, which means many of the affected customers never dealt with the company directly and may not recognize the name. That gap is the risk: a valid claimant can leave $100 on the table simply by not realizing the notice applies to them.
What the $5.5 million Doxim settlement pays
The settlement offers two mutually exclusive cash options. A class member can take an estimated $100 payment with no documentation required, or instead claim up to $5,000 for out-of-pocket losses traceable to the breach, such as identity theft or fraud, provided they submit proof like receipts or bank statements. Both options also come with an offer of a free year of credit monitoring, a benefit worth using given that stolen data can sit unused for months before criminals act on it.
For most people, the flat $100 is the realistic choice because it asks for nothing but a valid claim form. The documented-loss path only makes sense for someone who can actually tie a fraudulent charge, a drained account, or the cost of resolving identity theft to this specific incident, and who has kept the paperwork to prove it. Inflating a documented claim is a losing move: administrators verify these figures, and an unsupported claim can be reduced to nothing.
The $100 figure carries an asterisk worth understanding. The settlement describes it as an estimated payment, which means the actual amount can move up or down after the claim window closes: if valid claims arrive heavier than expected, the per-person cash is trimmed on a pro rata basis so the fixed $5.5 million fund, minus attorney fees and administrative costs, stretches across everyone who filed. That is a reason to file early and accurately rather than treat the round number as guaranteed. It also explains why the no-documentation option exists at all, since it lets ordinary class members collect a share of a capped fund without the delay and audit risk that come with assembling proof of specific losses.
Free retirement updates: Enrollment and claim windows come and go, and missing one can cost real money. The free Retirement Shield newsletter keeps readers ahead of the deadlines that matter. Sign up free.
Who was exposed, and why the credit-union link matters
The breach itself dates to December 2023, when an unauthorized party accessed Doxim’s systems. Because Doxim handles statement and tax-document processing for financial institutions, the exposed information belonged to the customers of those institutions rather than to Doxim’s own direct clients, which is how a person who has never heard of the company can still be a member of the settlement class. The litigation over the incident alleged the vendor failed to adequately protect that data.
The type of data a statement processor holds is what makes this exposure worth taking seriously rather than shrugging off. Account statements and tax forms carry names, addresses, account details, and often Social Security numbers, the exact combination that enables someone to open credit in a victim’s name or file a fraudulent tax return. For older adults, who are disproportionately targeted for financial fraud, that is a reason to claim the credit monitoring alongside the cash rather than skip it.
Eligibility comes down to whether a person received a notice about the Doxim incident, which is the practical marker of class membership. Anyone who got such a notice from Doxim or from their credit union in connection with the breach should treat it as the entry point to the claim rather than as junk mail, since it is the document that establishes the right to file.
Meeting the October 13 deadline, and what “final” still depends on
Claims must be submitted online by 11:59 p.m. Eastern on October 13, 2026, or mailed to the settlement administrator and postmarked by the same date. The filing runs through the official administrator’s site, there is no cost to submit, and no legitimate step in the process asks a claimant to pay a fee or hand over a bank password to “release” the payment. Those requests are the signature of the copycat scams that trail every publicized settlement.
One nuance separates this from money already in hand: the settlement is not final yet. A final approval hearing is scheduled for late October 2026 in the U.S. District Court for the Eastern District of Michigan, and payments are only distributed after the court approves the deal and any appeals are resolved. As a result, filing before October 13 secures a place in line, but the actual payout arrives later and its timing is not yet set.
The takeaway for a would-be claimant is to act on the deadline that is fixed and ignore the timeline that is not. The $100 is real and the paperwork is minimal, but the claim only counts if it is filed by October 13 through the official channel, and the smartest version of this pairs the cash claim with the free credit monitoring, since the data behind this breach can surface as fraud long after the settlement check clears.
This article was produced with AI assistance and reviewed against primary sources by The Money Overview editorial team.
More Financial Reading
