$1.75M CUSO Financial Services Data Breach Settlement: Claims Due November 16

Key facts

Case: Stan Sinitsa v. CUSO Financial Services, L.P., Case No. VCU326251
Court: California Superior Court for Tulare County
Settlement fund: $1.75 million, before approved fees, costs, awards, administration, and benefits
Who is included: Approximately 76,251 U.S. residents who received CUSO's October 2024 notice that their private information may have been compromised
Claim deadline: November 16, 2026
Rights deadline: October 1, 2026 to opt out or object
Current status: Proposed settlement. The court has not made a finding that CUSO did anything wrong.

What happened

CUSO Financial Services, L.P. has agreed to fund a proposed $1.75 million class action settlement over a cybersecurity incident involving a third-party communications-archiving service. The court-authorized settlement website says the incident occurred between December 19, 2023 and January 19, 2024. CUSO disclosed the incident to affected people in October 2024.

The filed settlement agreement gives more detail. It says an unauthorized person accessed one CUSO employee's account on a third-party service used to archive communications for regulatory purposes. After investigating, CUSO notified people whose information may have been compromised and offered identity-theft and credit-monitoring services.

A settlement does not mean the allegations were proved. CUSO denies negligence, fault, wrongdoing, and liability. The court has not decided the merits of the claims. The agreement would resolve the dispute if the court grants final approval and the settlement becomes effective.

Current status

This is a proposed settlement, not a judgment that CUSO violated the law. Payments and monitoring under the settlement depend on final approval and the resolution of any appeals.

Who CUSO is and why it held consumer information

CUSO Financial Services is a financial-services firm that places and supports investment programs inside banks and credit unions. Its company materials describe it as a broker-dealer and investment adviser that supplies financial professionals, investment technology, wealth-management services, retirement services, and insurance solutions through partner financial institutions.

That structure explains how a consumer may have interacted with CUSO without recognizing the company name. A person may have used investment or advisory services offered through a bank or credit union while CUSO provided or supervised the underlying investment program. The settlement record says the affected account was connected to a service used to archive communications, a compliance function required for regulated financial firms.

The settlement agreement describes the exposed category as "Private Information," meaning information that could identify a person alone or when combined with other data. It specifically lists names, Social Security numbers, and driver's license or state identification numbers. The Maine Attorney General's breach record identifies CUSO as a financial-services organization and confirms that notices offered monitoring and identity-protection services.

What the lawsuit alleged

The plaintiff claimed CUSO failed to protect private information connected to the incident. The settlement agreement lists legal theories that included negligence, breach of contract or implied contract, invasion of privacy, unjust enrichment, consumer-protection claims, and claims under data-breach notification laws.

Those are allegations and released legal theories, not findings. CUSO says it would have prevailed and that a litigation class would not have been certified. The parties exchanged information and participated in multiple mediation sessions before reaching an agreement in principle in August 2025.

A "settlement class" is a group certified only to resolve a case on negotiated terms. It is different from a trial class. If the settlement does not become final, the agreement says the settlement-only certification can be vacated and the parties return to their prior positions.

Who may be included

The filed agreement defines the settlement class as U.S. residents whose private information may have been compromised in the December 2023 to January 2024 cybersecurity incident and who received CUSO's data-breach notice around October 2024. The agreement estimates approximately 76,251 people are included.

People should not rely on that broad description alone. The court-authorized website and mailed notice control individual eligibility. A notice or the claim credentials supplied by the administrator are the clearest indicators that CUSO identified a person as a class member.

A California subclass covers settlement class members who were California residents at the time of the incident. The extra California benefit requires proof of California residence on December 19, 2023, such as a qualifying utility bill, tax document, or pay stub bearing the claimant's name and address.

Who should check their notice

The settlement is notice-based. It is aimed at people CUSO identified as affected and notified, not every customer of a bank or credit union that has worked with CUSO.

What benefits are available

A class member must submit a timely, valid claim to receive settlement benefits. The agreement provides several possible benefit paths.

Two years of monitoring

Approved claimants may elect two years of IDX three-bureau credit monitoring. The agreement describes monitoring and alerts, dark-web monitoring, identity-restoration help, lost-wallet assistance, and up to $1 million in reimbursement insurance under the monitoring product. This benefit is separate from any earlier monitoring CUSO offered after the incident.

Up to $5,000 for documented losses

Class members may seek reimbursement of up to $5,000 for reasonable, documented losses fairly traceable to the incident and not already reimbursed. Documentation matters. A claimant should expect to provide records showing the cost or loss and its connection to the incident.

The $5,000 figure is a maximum, not an automatic payment. Approved documented-loss claims can be reduced proportionally if the fund cannot cover all approved benefits and court-approved expenses.

Up to $100 for qualifying California residents

Members of the California subclass may seek a statutory payment of up to $100. The filed agreement says claimants must document California residence on December 19, 2023. This payment may also be reduced if approved claims exceed the money available.

Residual cash payment of up to $599

Class members may elect a residual cash payment capped at $599. The word "residual" is important. The amount comes from money remaining after monitoring, documented-loss claims, California payments, administration, approved fees, expenses, and awards. The final payment can be much less than $599 and depends on the remaining fund and the number of approved claims.

The $599 amount is a cap

The agreement does not promise a $599 payment. It requires the administrator to divide remaining money among approved claimants, so claim volume and other approved costs will determine the actual amount.

The benefit categories have interaction rules that the claim form controls. Class members should read the form carefully rather than assuming every cash category can be stacked without limitation.

Deadlines and next steps

The court-authorized website lists three controlling dates:

October 1, 2026: deadline to request exclusion from the settlement
October 1, 2026: deadline to object to the settlement
November 16, 2026: deadline to submit a claim

Opting out and objecting are different. A person who opts out receives no settlement benefit but preserves the ability to bring their own released claims. A person who stays in the class may object, but remains bound if the settlement becomes final. Filing a claim seeks a benefit and does not itself remove a person from the settlement.

Class members should use the official website named in their notice. They should retain the notice, claim confirmation, supporting documents, and any payment or monitoring communication. Class Action Pulse does not process claims and should not receive Social Security numbers, driver's license images, account records, or other sensitive documents.

Practical step

Submit through the court-authorized settlement website and keep the confirmation. Do not send claim evidence or identification documents to Class Action Pulse.

Case timeline and current procedural status

December 19, 2023 to January 19, 2024: the settlement record says unauthorized access occurred through a third-party archiving service.
January 19, 2024: CUSO says it became aware of the incident.
October 2024: CUSO sent notice to people whose information may have been compromised.
Late 2024: proposed class actions followed the notification.
August 29, 2025: the parties reached a settlement after mediation, according to the agreement.
2026: the Tulare County court authorized settlement notice and the current claim process.
October 1, 2026: opt-out and objection deadline.
November 16, 2026: claim deadline.

What remains unresolved

The settlement does not establish that CUSO caused compensable harm to every class member or violated any law. It does not establish the final residual payment. That amount depends on approved claims and deductions from the fund. It also does not guarantee that a documented-loss submission will be approved. The administrator must evaluate whether the records satisfy the settlement rules.

The court must still decide whether the settlement is fair, reasonable, and adequate. Even after approval, appeals could delay benefits. Class members should check the official website for hearing updates and any revised schedule.

Frequently asked questions

Is this settlement for every CUSO or credit-union customer?

No. The settlement is for people whose information may have been compromised in the specified incident and who received CUSO's notice. The administrator determines membership under the court-approved definition.

Can every claimant receive $599?

No. $599 is the maximum residual cash payment. The actual payment may be lower because it comes from funds left after other benefits and approved expenses.

What proof is required for the $5,000 loss benefit?

The agreement requires documentation of reasonable losses fairly traceable to the incident and not already reimbursed. Receipts, statements, and other records connecting the expense or loss to the incident may be needed.

Do California residents receive an extra payment automatically?

No. The California payment is claim-based and requires proof that the claimant lived in California on December 19, 2023. It is capped at $100 and may be reduced.

Is CUSO admitting wrongdoing?

No. CUSO denies the allegations, and the court has not made a liability finding.

Should I pay anyone to file a claim?

No fee is listed for filing through the court-authorized website. Be cautious of anyone asking for payment or sensitive information outside the official process.