Communications Data Group breach settlement

The defendants deny wrongdoing, and the settlement is not a finding that they are liable. This explanation relies on the agreement and court-authorized notice. The materials differ on some wording about membership and hearing time. Those differences are disclosed below; a notice, a submitted claim or the advertised cap does not guarantee a payment.

A proposed settlement provides benefits following a ransomware incident at Communications Data Group, Inc., or CDG. Ransomware is malicious software used to interfere with computer systems, often to demand payment. The agreement says CDG was alerted to its unauthorized deployment on February 13, 2025 and later identified potentially affected customer information.

The case is Pierce et al. v. Communications Data Group et al., No. 2026CH000032, in the Circuit Court of Champaign County, Illinois. Eligible notice recipients can request $45 alternative cash, reimbursement of qualifying documented losses or credit monitoring, subject to combination rules. Claims are due November 10, 2026. A final court decision is still pending.

CDG supplies cloud-based billing software to telecommunications and broadband providers. Those providers use it for services such as voice, internet and related customer billing. Its role matters because customers may have supplied information to their telephone or internet company rather than directly to CDG.

The other defendants are Duo County Telephone Cooperative Corporation, Inc., Cumberland Cellular, LLC and Home Wireless, Inc. The agreement groups Duo County Telephone and Cumberland as providers serving rural Kentucky. Home Wireless is identified as Home Telecom, a telecommunications and broadband provider serving South Carolina. The agreement says these providers used CDG's billing services. A DUO announcement from April 2024 separately confirms selecting CDG for online billing accounts and mailed statements.

Shannon Pierce, Michelle Watson, Rilda Firkins, Briana Acuna, Michael Daniell, Cara Haenel and Deborah Ware are the named plaintiffs acting for the proposed class. Class counsel are Raina Borrelli of Strauss Borrelli, Gary Klinger of Milberg and William Federman of Federman & Sherwood. Simpluris handles administration, while CyEx supplies monitoring. Judge Jason B. Bohm oversees the state-court case; neither the administrator nor this website decides whether the settlement is legally approved.

The agreement places discovery of the ransomware incident on February 13, 2025. Its forensic investigation found that private information may have been compromised, accessed or taken. The potentially involved records include names, addresses, birth dates, driver's license information, bank account information and Social Security numbers, and for some people customer proprietary network information. The latter means protected information connected to a customer's telecommunications services; it is not a statement that every listed data category was involved for everyone.

The agreement describes several resulting lawsuits. A consolidated complaint was filed in federal court in the Central District of Illinois on October 20, 2025, No. 2:25-cv-02170. On November 20, that court stayed the case while mediation proceeded. A stay pauses litigation; it does not decide who should win.

The parties mediated on January 20, 2026 and agreed on material settlement terms. The plaintiffs dismissed the consolidated federal complaint on February 3 and filed the state action on March 27, 2026. The official settlement site lists September 11, 2026 as the notice mailing date. These dates show the path from incident to claims, rather than establish liability for the underlying attack.

The notice says the plaintiffs assert negligence, negligence per se, implied-contract and third-party-beneficiary contract claims, unjust enrichment and a request for declaratory judgment. In plain language, they contend duties to protect information were breached, including duties they say arose from contracts or law. A third-party beneficiary theory concerns a contract allegedly intended to benefit someone who did not sign it; declaratory relief asks the court to state the parties' legal rights.

All four defendants deny the claims and wrongdoing. The agreement says they settled to avoid litigation burdens while maintaining defenses. The plaintiffs agreed to seek recovery through settlement rather than risk continued litigation. The court has not found that the defendants are responsible for the alleged harm. Notice and preliminary approval allow the proposal to be considered, but final approval remains a separate decision.

Section 66 of the agreement defines the class as U.S. residents who received a Notice of Data Incident letter from CDG or Home Telecom. The FAQ and part of the long-form notice use broader wording about information potentially impacted, including mailed notifications, while the notice's opening says a letter is required. This article uses the agreement's notice-based definition. If you lack a letter, ask Simpluris at (866) 601-3534 to confirm membership before claiming eligibility.

Being a customer of a named provider does not by itself prove inclusion. The record does not show that every customer was affected, nor that each affected person has a payable loss. A valid exclusion request removes a person from settlement benefits even if that person otherwise meets the definition.

Use the official settlement website to submit a claim or obtain a printable form. Choose an allowed benefit combination and provide accurate contact information. Loss claims need reasonable supporting records, such as bank statements, receipts, invoices or telephone records, plus a declaration under penalty of perjury. A personal statement alone is not sufficient documentation.

Submit online or send a paper form postmarked by November 10, 2026. The administrator's address is Communications Data Group Settlement, c/o Settlement Administrator, PO Box 25226, Santa Ana, CA 92799-9958. Save a copy and confirmation. If Simpluris sends a deficiency notice requesting more information, respond in time; the official notice says an unanswered request can make a claim invalid. An inquiry on Class Action Pulse does not file this official claim.

The $45 alternative payment replaces both documented-loss reimbursement and monitoring. It is not an extra benefit added to those selections. Documented-loss reimbursement can be combined with monitoring, and monitoring alone is also available.

The loss cap is $5,000 for qualifying actual, unreimbursed expenses incurred on or after February 2025. The loss must be more likely than not caused by the incident, and you must have made reasonable efforts to avoid the expense or seek reimbursement. The notice gives examples including fraud losses, professional credit-repair fees and reasonable incident-related costs. A maximum cap is not a promise to pay every requested amount.

Monitoring is three years of CyEx coverage through one major credit bureau, not all three. It includes identity-theft insurance up to $1 million without a deductible, subject to its coverage terms. That limit is not a cash award. CDG funds the settlement benefits and administration; the reviewed materials do not state a single fixed aggregate fund.

Class counsel will request fees including litigation expenses up to $500,000 and service awards up to $2,500 for each class representative. The court must approve these payments and may award less. They are distinct from class-member benefits and should not be treated as an individual payout estimate.

Claims are due November 10, 2026. Opt-out requests must be postmarked by October 26, 2026. Opting out gives up settlement benefits while preserving the ability to pursue covered claims separately. The notice specifies a signed individual request and required contact information.

Objections are also due October 26, 2026. The notice's summary says received by that date, while its detailed paragraph uses postmarked language and also requires court filing. Follow the full notice and allow delivery and filing by October 26, or confirm instructions with the administrator. An objection challenges the proposal while keeping you in the class; it is different from opting out.

The final hearing is scheduled for November 16, 2026. The long-form notice and FAQ list 10:30 a.m. Central Time, while the homepage date strip says 10 a.m. Confirm current hearing arrangements before attending. The court can change the schedule. Staying in the class releases covered incident-related claims if the settlement becomes final; doing nothing brings no benefits but can still bind you to that release.

The court will consider approval, objections, fees and awards. Claims must also be reviewed. Payments depend on final approval and resolution of possible appeals, so no payment date is established here. The administrator can reject claims that fail eligibility, proof or response requirements.

Read the agreement's full release before deciding how to proceed. Contact class counsel or your own lawyer about legal-rights choices, and use Simpluris for claim and membership questions. Source inconsistencies do not justify guessing at broader eligibility or treating a proposed benefit as already owed.