International Shoppes LLC and Diplomatic Duty Free Shops of New York Inc. have agreed to a proposed class action settlement over a November 2023 cyberattack that allegedly exposed personal information. People included in the settlement may claim two years of CyEx Financial Shield Complete and choose either reimbursement of up to $4,000 for documented out-of-pocket losses or an estimated $50 cash payment. Claims must be submitted online, emailed, or postmarked by November 11, 2026.
The settlement does not mean a court found that International Shoppes violated the law. The companies deny wrongdoing, and the court has not decided which side is right. Benefits will not be distributed unless the court grants final approval and any appeals are resolved.
Key facts
- Case: Peter Lazar and Sheba Khan v. International Shoppes, LLC and Diplomatic Duty Free Shops of New York, Inc., Index No. 623891/2025
- Court: Supreme Court of the State of New York, Nassau County
- Who is included: U.S. residents whose personal information was compromised in the incident discovered by the defendants in December 2023, including people who received an incident notice
- Available benefits: Two years of financial monitoring plus either documented-loss reimbursement up to $4,000 or an estimated $50 alternative cash payment
- Aggregate cap: $500,000 for the payment benefits, with proportional reductions possible
- Opt-out and objection deadline: October 12, 2026
- Claim deadline: November 11, 2026
- Final approval hearing: November 16, 2026
- Current status: Proposed settlement awaiting final approval
In this article
- What happened
- Who International Shoppes is
- Who may be included
- What benefits are available
- How to file a claim
- What the lawsuit alleged
- Case timeline and current status
- What remains disputed
- What happens next
- Frequently asked questions
What happened
The court-authorized settlement website says International Shoppes experienced a cyberattack on its computer systems in November 2023. Certain files containing personal information were accessed. The notice lists possible information types including names, addresses, birth dates, Social Security numbers, driver's license and passport information, financial account numbers, and health information.
A data incident is the settlement documents' term for this cyberattack and the related access to files. It does not mean every listed data element was exposed for every person. The class definition turns on whether a person's personal information was compromised, and the settlement website says people who received notice are indicated by company records to be class members.
Plaintiffs Peter Lazar and Sheba Khan pursued claims against International Shoppes LLC and Diplomatic Duty Free Shops of New York Inc. The parties eventually negotiated the proposed resolution now before the New York court.
What changed A court-authorized claim process is now open. Affected people can request settlement benefits, but submitting a form does not guarantee approval or payment.
Who International Shoppes is
International Shoppes describes itself as a duty-free and specialty retail operator in U.S. airports. According to its company website, it was founded in 1951, is headquartered in Valley Stream, New York, and operates airport stores in locations including New York, Hawaii, Washington, D.C., Maryland, Connecticut, and Texas.
Travelers encounter the company through airport retail locations and its online reservation system. Its website explains that customers can select a flight, reserve and pay for merchandise, then pick up an order in a store or at a gate. The settlement, however, is about the defendants' handling of personal information allegedly involved in the November 2023 cyberattack—not the price, quality, or tax treatment of duty-free merchandise.
Diplomatic Duty Free Shops of New York Inc. is the second named defendant. The settlement documents collectively refer to it and International Shoppes LLC as International Shoppes or the defendants. The court-authorized materials do not say that every airport shopper is affected; inclusion depends on the data-incident records and class definition.
Who may be included
For settlement purposes, the court defined the class as all individuals residing in the United States whose personal information was compromised in the data incident discovered by the defendants in December 2023, including everyone who received notice of the incident.
The class excludes the judge and the judge's family and staff; International Shoppes and its officers, directors, and related companies; and anyone who submits a valid request to be excluded. The deadline to opt out is October 12, 2026.
An opt-out, also called exclusion, removes a person from the settlement. Someone who validly opts out receives no settlement benefits but keeps the ability to pursue their own lawsuit about the released claims, subject to applicable law and deadlines. A person who stays in the class is bound by the settlement's release if the deal becomes final.
People who are uncertain whether they are included can contact the settlement administrator, Simpluris, using the contact information on the official site. A notice ID can help connect a submitted claim with the defendants' records, although the official claim form says to provide it if known.
The notice is the strongest signal The official website says recipients of settlement notice are identified in International Shoppes' records as class members. Receipt of notice still does not guarantee that a particular claimed expense will be approved.
What benefits are available
Class members may request two years of CyEx Financial Shield Complete. The official FAQ describes the service as including $1 million in financial-fraud insurance, monitoring for fraud or identity theft, unauthorized financial transactions, and high-risk financial transactions, plus access to a fraud-resolution agent if suspicious activity occurs.
That monitoring benefit may be claimed together with one of two payment options.
Documented out-of-pocket losses
A class member may request reimbursement of up to $4,000 for actual, documented losses caused by the data incident. Eligible losses must have occurred from November 16, 2023 through November 11, 2026.
The official materials give examples including identity-theft or fraud losses, fees for credit reports or monitoring, costs to freeze or unfreeze credit, replacement-identification costs, and postage used to contact banks. Claimants must provide proof such as receipts or bank statements. Notes prepared by a claimant may explain other evidence, but the claim form says self-created notes alone are not sufficient. Expenses already reimbursed by another party cannot be claimed again.
Alternative cash payment
Instead of documented-loss reimbursement, a class member may request a one-time cash payment expected to be $50. No separate documented-loss showing is required for this option, but the payment is not guaranteed at $50.
The settlement places an aggregate cap of $500,000 on the payment benefits. If approved claims exceed that amount, payments will be reduced pro rata, meaning proportionally, so their combined value fits within the cap. The monitoring benefit is presented separately in the official materials.
Choose one cash path A claimant may request monitoring plus either documented-loss reimbursement or the alternative cash payment. The claim form does not permit both payment options.
How to file a claim
The court-authorized website is IShoppesDataSettlement.com. Claims may be submitted through the online form. The official claim form also says a completed form may be sent by U.S. mail or emailed to the settlement administrator.
The deadline is November 11, 2026. An online or emailed claim must be submitted by that date, and a mailed claim must be postmarked by that date. Claimants requesting out-of-pocket reimbursement should gather records that show both the amount and why the expense was more likely than not connected to the data incident.
The form asks for contact information, benefit selections, payment information when applicable, and an attestation under penalty of perjury that the submitted information and documentation are true and correct to the claimant's knowledge. The administrator may request supplemental information before treating a claim as complete and valid.
Payment choices listed on the official form include PayPal, Venmo, Zelle, and a physical check. Claimants should use only the court-authorized website and documents when submitting sensitive information.
Controlling deadline Claims are due November 11, 2026. The separate October 12 deadline controls exclusion and objections, not benefit claims.
What the lawsuit alleged
The lawsuit alleged that personal information was accessed during the November 2023 cyberattack and asserted claims concerning the defendants' protection of that information. The settlement agreement records that earlier federal litigation included negligence, breach-of-implied-contract, declaratory-judgment, unjust-enrichment, fiduciary-duty, and New York deceptive-practices theories.
According to the agreement's procedural history, a federal court dismissed some claims in May 2025 while allowing negligence, breach-of-implied-contract, and declaratory-judgment claims to continue. A partial ruling on a motion to dismiss is not a final determination that the remaining allegations are true. It means only that specified claims were permitted to proceed at that stage.
The defendants filed an answer denying liability. The parties later attended mediation in October 2025 and reached a settlement in principle. The federal action was dismissed without prejudice, and the matter was refiled in the Supreme Court of the State of New York, Nassau County for settlement proceedings.
A proposed class action settlement is a negotiated agreement that still needs court approval. The court examines whether the deal is fair, reasonable, and adequate for the class. Preliminary approval authorizes notice and the claims process; it is not final approval and is not a finding of wrongdoing.
Case timeline and current status
- November 2023: The cyberattack occurred, according to the settlement materials.
- December 2023: The defendants discovered the data incident, according to the class definition.
- December 2024: The federal complaint was amended, as described in the settlement agreement.
- May 22, 2025: The federal court dismissed some claims and allowed others to proceed.
- June 25, 2025: The defendants answered and denied liability.
- October 22, 2025: The parties mediated and reached a settlement in principle.
- 2026: The parties executed the settlement agreement and moved the settlement proceeding to New York state court.
- October 12, 2026: Deadline to opt out or object.
- November 11, 2026: Claim deadline.
- November 16, 2026: Scheduled final approval hearing.
The court may change the hearing date. Class members do not have to attend to receive benefits, but anyone considering an objection should follow the official notice's instructions.
What remains disputed
International Shoppes denies that it did anything wrong. The court has not decided whether the plaintiffs or defendants are right, and the proposed settlement is not an admission of liability.
The public settlement record also does not establish that every type of information listed in the notice was involved for every person. Nor does it guarantee that the estimated $50 alternative payment will remain $50 after all valid claims are counted. The administrator must review claims, and the aggregate cap can reduce payments proportionally.
The record does not provide a payment date. Distribution depends on final approval and the resolution of any appeals. Appeals may delay benefits, and the official FAQ says their timing cannot be predicted.
What happens next
Class members must decide separately whether to submit a claim, object, opt out, or do nothing. Those choices have different consequences. A person can object and still file a claim, but a person who opts out cannot receive settlement benefits.
If the court grants final approval after the November 16 hearing and no appeal prevents the settlement from becoming effective, the administrator can process approved benefits. If the settlement is not approved, the proposed benefits will not be distributed under this agreement.
Class members should keep a copy of their submitted claim and supporting records. They should also monitor the official website for hearing changes, orders, or payment updates.
Frequently asked questions
Is this a final settlement?
No. It is a proposed settlement. The court still must decide whether to grant final approval, and appeals may follow.
Who may qualify?
The class generally covers U.S. residents whose personal information was compromised in the International Shoppes data incident discovered in December 2023, including people who received incident notice. The official administrator makes claim determinations.
Can a claimant receive monitoring and cash?
Yes. The official materials permit monitoring plus one payment option: either qualifying documented-loss reimbursement up to $4,000 or the alternative cash payment expected to be $50.
Is the $50 payment guaranteed?
No. The payment is an estimate. The $500,000 aggregate cap may require proportional reductions based on the volume and value of approved claims.
What is the claim deadline?
Claims must be submitted online, emailed, or postmarked by November 11, 2026. Opt-outs and objections are due earlier, on October 12, 2026.
Does filing a claim waive legal rights?
Remaining in the settlement class means the person will be bound by the settlement release if the agreement becomes final. The full release appears in the settlement agreement. People considering their individual legal rights may wish to consult their own attorney.
Sources
- Court-authorized International Shoppes Data Incident Settlement website
- Court-authorized settlement FAQ
- Court-authorized claim form
- International Shoppes — About Us
Class Action Pulse is a news and information service, not a law firm. This article is general information and not legal advice. Eligibility and benefits are determined by the settlement documents and administrator.