Union Bank and Trust Reaches $2.4M Settlement Over MOVEit Data Breach: How to File Your Claim

Union Bank and Trust Co. has agreed to pay $2,389,976 to settle a class action lawsuit alleging the financial institution failed to protect customer data during a May 2023 cyberattack. Affected consumers can receive up to $10,000 in cash reimbursement or a $100 flat payment, plus two years of free credit monitoring.

What Happened in the Union Bank and Trust Cyberattack?

In late May 2023, cybercriminals exploited a critical vulnerability in MOVEit Transfer, a popular third-party file transfer software used by financial institutions, corporations, and government agencies worldwide. Union Bank and Trust Co. utilized this software to handle sensitive customer files and transactional records. Between May 27 and May 31, 2023, unauthorized actors breached the bank’s file transfer environment and accessed confidential records belonging to approximately 207,824 consumers.

Affected customers filed a federal class action lawsuit, Scott, et al. v. Union Bank and Trust Co., et al., in the U.S. District Court for the District of Massachusetts. The plaintiffs alleged that the Nebraska-based bank failed to implement basic, reasonable cybersecurity safeguards to shield customer records from predictable cyber threats. Although Union Bank and Trust denies all allegations of wrongdoing and maintains that its security protocols were reasonable, the institution agreed to establish a $2.4 million settlement fund to resolve the litigation and avoid prolonged court battles.

What Personal Information Was Exposed in the May 2023 Incident?

When cybercriminals compromise a financial institution, the exposed data often contains sensitive identifiers that can be exploited for identity theft, bank fraud, and targeted phishing schemes. The Union Bank and Trust incident was no exception. According to court documents, the cyberattack compromised personally identifiable information (PII) entrusted to the bank by current and former account holders.

The specific data types exposed in the breach include:

• Full legal names and contact details

• Social Security numbers (SSNs)

• Financial account details and banking records

• Government-issued identification numbers

• Other personal data stored in compromised file transfers

For everyday people, the compromise of a Social Security number combined with financial account records poses a severe, long-term threat. Unlike a credit card that can be quickly reissued, a Social Security number remains tied to your identity for life. Exposure of this information significantly increases the risk of fraudulent tax filings, unauthorized credit applications, and account takeovers.

How Much Can You Receive From the $2.4 Million Settlement Fund?

The $2.39 million settlement agreement creates structured cash awards designed to reimburse class members for financial losses, lost time, and out-of-pocket expenses resulting from the cyberattack.

Eligible class members can choose between two main financial recovery options:

1. Reimbursement for Ordinary Losses (Up to $2,500): You can claim compensation for documented out-of-pocket expenses tied directly to the data breach. This includes bank fees, credit report costs, communication expenses, and up to four hours of lost time calculated at $25 per hour.

2. Reimbursement for Extraordinary Losses (Up to $10,000): If you suffered actual, documented financial fraud or identity theft between May 31, 2023, and the close of the claims period that was not reimbursed by your bank or insurance, you can claim up to $10,000.

3. Alternative Cash Payment ($100): If you did not suffer financial losses or prefer not to submit documentation, you can select a hassle-free flat cash payout of $100 (subject to pro-rata adjustments based on overall claim volume).

Free Credit Monitoring and Identity Theft Protection for Affected Customers

In addition to direct monetary payments, every eligible class member can enroll in two years of free three-bureau credit monitoring and identity theft protection services. This service monitors your credit files across Equifax, Experian, and TransUnion in real-time, alerting you immediately if new accounts or unauthorized inquiries appear in your name.

Comprehensive credit monitoring is one of the most effective tools for catching identity theft early. The identity protection package provided under the settlement also includes up to $1 million in identity theft insurance coverage and access to dedicated fraud resolution specialists who can help restore your credit if your identity is compromised.

Even if you choose to claim the $100 flat cash payment or seek reimbursement for out-of-pocket expenses, you remain fully eligible to sign up for the free two-year credit monitoring service.

What Are Your Consumer Legal Rights in Banking Data Breaches?

When you deposit money or secure a loan with a bank, you entrust that institution with your most sensitive personal financial records. Under federal and state consumer protection laws, financial institutions have a strict legal obligation to maintain robust administrative, technical, and physical safeguards to keep your private data safe.

When financial organizations fail to adopt adequate cybersecurity measures, consumers can hold companies accountable through class action litigation. Federal statutes like the Gramm-Leach-Bliley Act (GLBA) and state privacy regulations—such as the California Consumer Privacy Act (CCPA)—require companies to handle customer data responsibly and provide timely notification when a security breach occurs.

Class action lawsuits level the playing field for everyday people. Individual consumers rarely have the financial resources to litigate against a regional or national bank on their own. By joining together in a class action, impacted customers can secure meaningful compensation and demand better data security standards across the banking industry.

You May Be Eligible: How to Submit Your Claim Before the Deadline

You are considered a settlement class member if you received a written data breach notification from Union Bank and Trust Company stating that your personal information was potentially compromised during the May 2023 MOVEit security incident.

To receive any settlement cash or credit monitoring benefits, you must take action immediately:

• Claim Form Deadline: You must complete and submit a valid claim form by July 21, 2026.

• Submission Methods: Claim forms can be submitted online through the official settlement website using the Claimant ID and Password listed on your breach notice. Alternatively, paper claim forms must be postmarked by July 21, 2026.

• Key Dates: The court deadline to exclude yourself or object to the settlement passed on June 22, 2026. The final court approval hearing is scheduled for August 6, 2026.

If you fail to submit a claim by the July 21 deadline, you will forfeit your right to receive cash compensation or free credit monitoring from this settlement fund.