ECSI $6.5 million breach settlement opens claims through December 21

Estimated reading time: 10 minutes.

Key facts

Educational Computer Systems, Inc., known as ECSI, has a proposed $6.5 million data-breach settlement.
The incident involved a guest tax-document search feature between October 29, 2023 and February 12, 2024.
The settlement covers U.S. residents whose personal information was potentially accessed, subject to exclusions.
Eligible claimants can choose documented-loss reimbursement up to $5,000 or an alternative cash payment estimated at about $100. They cannot receive both.
Claims must be submitted online or postmarked by December 21, 2026. Objection and exclusion deadlines are November 20, 2026.
Final approval remains pending. A telephone hearing is scheduled for January 11, 2027 at 9:30 a.m. Eastern Standard Time.

What the ECSI settlement changes

People whose information was potentially accessed in a cyberattack on Educational Computer Systems, Inc. can now review a court-authorized settlement notice and submit a claim through the official administrator. The proposed agreement establishes a $6.5 million fund, with payments subject to claim review and final court approval.

The case is Hood, et al. v. Educational Computer Systems, Inc., No. 2:24-cv-00666-CCW, in the U.S. District Court for the Western District of Pennsylvania. That is the federal trial court handling the consolidated litigation. Consolidation means related lawsuits were brought together for coordinated handling rather than treated as unrelated disputes.

Judge Christy Criswell Wiegand granted preliminary approval on August 5, 2026. Preliminary approval permits notice and a claims process while the court considers the settlement; it is not final approval or a finding that ECSI was legally responsible for every alleged harm.

ECSI denies wrongdoing and liability. The notice says the court has not decided in favor of either side. The settlement is a negotiated resolution intended to avoid further litigation risk and expense, not a trial verdict establishing the plaintiffs' allegations.

A claim window is open, but payments are not immediate

The administrator can accept claims now. Distribution depends on final approval and resolution of any appeals.

Why a college financial-services vendor held the data

ECSI provides financial-management services to colleges and universities. The consolidated complaint describes student-loan servicing, tuition payment plans, tax-document services and other work for those institutions. Students and borrowers can encounter the company through a school's financial processes rather than by separately choosing a tax-document vendor.

For this dispute, the relevant service is preparation and delivery of education-related tax forms. The complaint identifies ECSI's TaxSelect service as a system that processes institution-supplied information, generates forms and makes those documents available online. It is the handling of those records, not a disagreement over tuition or a student-loan balance, that underlies the case.

Form 1098-E reports student-loan interest paid. Form 1098-T reports education-related tuition information. Such forms contain personal and financial details necessary for the reporting function. Describing the forms does not mean every person whose record was involved qualifies for a tax deduction or credit; this article concerns data access and settlement rights, not tax eligibility.

The preliminary order identifies information potentially involved as names, addresses, email addresses, school names, ECSI internal identifiers, relevant tuition, scholarship or interest amounts, and the last four digits of Social Security numbers. In limited cases, full Social Security numbers may have been involved.

The order says information concerning approximately 2,577,994 individuals may have been affected. That is a potential-impact figure. It is not a count of people proven to have suffered identity theft, approved claims or expected payments.

The guest tax search incident

A guest search feature lets a person retrieve information without first signing into a full account. The complaint alleges that ECSI's former guest tax search functionality allowed access to tax forms using insufficient identifying information and without adequate verification of the requester.

According to the pleading, attackers exploited that design between October 29, 2023 and February 12, 2024. The plaintiffs allege that ECSI failed to notice the activity for months and shut down the functionality after detecting unusually high access attempts. Those details are allegations from the complaint, not independent technical testing by Class Action Pulse.

The court's preliminary order describes a criminal cyberattack targeting the guest tax search feature and potential access to the information on the forms. Potential access means the record supports exposure risk without proving the same outcome for every individual. It does not establish that each listed data category was present in every person's document.

The complaint also alleges injuries and increased risk of identity theft. The settlement notice preserves ECSI's denial and the absence of a merits ruling. Readers should distinguish an incident's occurrence, claims about the adequacy of safeguards, and proof that a particular loss resulted from the incident.

The claims and case timeline

The original plaintiffs sought relief under several legal theories. Negligence alleges a failure to exercise a legally required level of care that caused harm. Unjust enrichment challenges retention of a benefit alleged to be unfair. Declaratory relief asks the court to state the parties' legal rights or duties.

The September 13, 2024 consolidated amended complaint also alleged breach of implied contract and invasion of privacy. An implied contract is an agreement alleged to arise from conduct rather than a written promise. The preliminary order records that the court dismissed those two claims on May 2, 2025 while allowing the remaining claims to proceed. Permission to proceed is not a finding that those remaining claims were proven.

The order records the following chronology:

October 29, 2023 through February 12, 2024. The period of the incident described in the settlement.
Beginning in March 2024. Related proposed class actions were filed in the Pennsylvania federal court.
September 13, 2024. The operative consolidated amended complaint was filed.
May 2, 2025. The court partly granted and partly denied ECSI's motion to dismiss, a request to end claims before further litigation.
May 23, 2025. ECSI filed its answer, its formal response to the complaint.
August and September 2025. The parties participated in mediation, a settlement process assisted by a neutral third party.
October 1, 2025. The parties accepted a mediator's proposal after earlier sessions did not resolve the dispute.
January 16, 2026. The settlement agreement was executed and submitted to the court.
August 5, 2026. The court granted preliminary approval and authorized notice.

The appointed class representatives are Joel Hood, Elias Nemiri, Gideon Bauer, Elizabeth Golec and Alexys Taylor. They pursue the case for the settlement group. Class counsel, the lawyers appointed to represent that group, are Nicholas A. Colella of Lynch Carpenter LLP and Nickolas J. Hagman of Cafferty Clobes Meriwether & Sprengel LLP.

Who is included and excluded

The settlement class consists of people residing in the United States whose personal information was potentially accessed in the incident. Being a college student, having a student loan or using an ECSI service at another time is not, by itself, the definition of membership.

Excluded are the assigned judge and the judge's staff or immediate family; people found criminally responsible for initiating, causing, aiding or abetting the incident, or who enter the specified no-contest plea; and people who validly request exclusion. A no-contest plea is a criminal plea that does not contest the charge, the category identified in the notice.

Angeion Group, LLC is the court-appointed settlement administrator. Its job includes notice, claims review and distribution if the settlement becomes final. It is separate from ECSI and the lawyers for the class. Readers unsure about membership can use DataSettlementECSI.com or call 1-877-726-4268.

The two cash options

The documented-loss option permits reimbursement up to $5,000, but never more than the qualifying loss established. The loss must be actual, unreimbursed and more likely than not caused by the incident. The notice identifies a qualifying period from October 29, 2023 through December 21, 2026.

Examples include relevant bank charges, credit reports, monitoring or identity-protection costs and other qualifying expenses. Claimants must provide reasonable documents showing both the amount and why the expense is connected to the incident. Statements, invoices, emails and receipts can support a claim. A self-prepared handwritten receipt alone is insufficient.

The alternative option is a cash payment estimated at approximately $100. It does not require proof of a monetary loss, but membership, a valid claim and administrator approval still matter. The estimate can increase or decrease on a pro rata basis, meaning proportionally under the settlement's allocation, depending on approved claims.

Choose one cash path

The notice expressly prohibits receiving both documented-loss reimbursement and the alternative payment. Neither the $5,000 cap nor the estimated $100 is a guaranteed award.

The $6.5 million is the overall settlement fund, not all cash reserved solely for claimant checks. The order says administration, taxes and court-approved fees and service awards are paid from it before distribution of the net fund. Class counsel plan to request fees, costs and expenses not exceeding one-third of the fund, and the notice describes proposed $2,500 awards for each representative. Those requests require court approval.

How to claim and the separate rights deadlines

Claims must be submitted online through the official settlement website or mailed with a postmark by December 21, 2026. Follow the official form's instructions, include the required information and signature, and provide documentation for the loss option. Filing a form with Class Action Pulse is not a submission to the administrator.

Exclusion and objection have a different deadline, November 20, 2026. Exclusion, also called opting out, removes a person from the settlement and preserves any individual rights they may have to sue over the released matters. It also means no settlement payment. An objection asks the court to reject or reconsider approval while the person remains in the class, subject to the notice's requirements.

If the settlement becomes final, remaining members release covered claims. A release gives up the ability to pursue the specified legal claims against the released parties. Doing nothing produces no payment, but does not by itself remove a person from that release.

The rights deadline comes before the claim deadline

November 20 governs objections and exclusion. December 21 governs claims. The procedures and consequences are different, so use the official notice rather than treating these dates as interchangeable.

What remains undecided

The final approval hearing is scheduled by telephone for January 11, 2027 at 9:30 a.m. Eastern Standard Time. The court will consider fairness, fees and representative awards, along with qualifying objections. The schedule can change; the official website is the reference for updates.

The available sources do not establish final approval, a guaranteed distribution date or the final alternative-payment amount. They also do not establish that every potentially affected individual experienced fraud. Individual loss causation and claim validity remain questions for the administrator under the settlement rules.

For other verified consumer matters, see the Class Action Pulse case directory. The official administrator, not that directory, controls this ECSI claim process.

Frequently asked questions

Who may qualify for the ECSI settlement?

U.S. residents whose personal information was potentially accessed in the October 2023 to February 2024 incident may qualify, subject to the official exclusions and claim requirements.

Is the alternative payment guaranteed to be $100?

No. Approximately $100 is an estimate that can increase or decrease based on approved claims and the settlement allocation.

Can I claim both cash options?

No. The notice allows either qualifying documented-loss reimbursement up to $5,000 or the alternative cash payment, not both.

When is the ECSI claim deadline?

Submit online or mail a claim postmarked by December 21, 2026. Objection and exclusion deadlines are November 20, 2026.

Has ECSI admitted wrongdoing?

No. The notice says ECSI denies wrongdoing and liability, and the court has not decided in favor of either side.

When would payments be made?

Payments depend on final approval and resolution of appeals. The January 11, 2027 hearing is not a promised payment date.