Finastra data breach settlement

Finastra denies wrongdoing, and the court has not decided which side is right. This page explains proposed benefits and legal choices using the court-authorized notice, agreement and claim form. The proposed fund is confirmed; your membership, claim approval, payment amount and payment date are not guaranteed.

Finastra Technology, Inc. has agreed to establish a $3,125,000 settlement fund over an October 2024 cybersecurity incident. Eligible notice recipients can request documented-loss reimbursement or a pro rata cash payment, along with a separate monitoring benefit. Claims are due November 27, 2026.

The case is Tina Parsley Hughes et al. v. Finastra Technology, Inc., No. CACE26013154, in the Circuit Court for Broward County, Florida. The dispute concerns files on a secure transfer platform, not a finding that every bank using Finastra was breached. The settlement remains subject to final court approval and any appeals.

Finastra supplies financial-services software for lending, payments and banking. Financial institutions use its systems to support their own services. The agreement says the affected files included private information belonging to certain clients' customers. A consumer therefore could be affected without recognizing Finastra's name or opening an account directly with it.

Tina Parsley Hughes, Baitul Javid, Benjamin Meredith and Robert Murray are the named plaintiffs representing the proposed class. Their attorneys are Jeff Ostrow of Kopelowitz Ostrow and Mariya Weekes of Milberg, the firms appointed to represent class members. Simpluris is the settlement administrator, handling notices, claims and communications rather than representing either side in court. CyEx supplies the Financial Shield Complete monitoring service. The Broward County court decides approval and requested fee and service awards.

The agreement says Finastra identified the incident on November 7, 2024. Its investigation found unauthorized access to the Secure File Transfer Platform at different times between October 31 and November 8, 2024, including access to certain files on October 31. A secure file-transfer platform is a system used to move files between authorized users; this incident concerns unauthorized access despite that intended protection.

The company notice filed with California's attorney general, dated June 30, 2025, describes potentially involved names, birth dates, Social Security numbers and financial account information. It says Finastra notified law enforcement and took security measures. Finastra also said it had no indication of further copying, retention, sharing or misuse. That is the company's statement, not a guarantee against later misuse or a court finding.

The agreement describes federal lawsuits consolidated in Polak v. Finastra Technology, Inc., No. 6:25-cv-01284, in the Middle District of Florida. The parties mediated on June 2, 2026, continued negotiations and reached settlement terms on June 17. They then dismissed the federal matter and filed the state-court action after determining state-court jurisdiction was proper. Those procedural steps explain why a 2024 incident now has a 2026 Florida settlement case number.

The plaintiffs seek recovery over private information accessed in the cyberattack. The agreement says they entered the settlement to recover on their claims and avoid litigation's risk, delay and uncertainty, without conceding that their claims lacked merit. Finastra expressly denies fault and liability and says it agreed to resolve the dispute and avoid further litigation burdens.

The notice says the court has not decided who is right. Allowing notice and claims to proceed before final approval does not establish liability or prove identity theft for an individual. At the final hearing, the court will evaluate the proposal, objections, attorney payments and service awards. The public materials reviewed do not establish a final judgment approving payment today.

The class is defined by residence, being alive and having been sent Finastra's notice about potentially impacted private information. You do not have to show a reimbursable loss merely to choose the pro rata cash benefit, but you must still be a class member. Ask Simpluris at (866) 719-4418 if membership or your notice information is unclear. The administrator uses records and claim information to verify eligibility.

Visit the official settlement website and use its claim form. Submit only one claim per person. The form asks for contact information, benefit selections, payment selection and a signed truthfulness attestation. If seeking reimbursement, provide records such as bank statements or receipts showing the loss and its connection to the incident. Self-created notes may explain other proof but cannot replace it.

Online submission by November 27, 2026 avoids inconsistent paper-mail wording. The notice and agreement say mailed claims must be postmarked by the deadline, while the downloadable form repeatedly says received by that date. If mailing, allow delivery by November 27 or confirm current instructions directly with Simpluris. Its address is Finastra Data Incident Settlement, PO Box 25226, Santa Ana, CA 92799-9958. Keep your confirmation and update the administrator if contact details change.

Documented-loss reimbursement covers qualifying actual out-of-pocket losses incurred between October 31, 2024 and November 27, 2026, up to $2,500. Examples in the notice include identity-theft or fraud losses, credit-report and monitoring fees, costs to replace identification and postage used to contact banks. Expenses already reimbursed by another party are not payable again.

Alternatively, choose a pro rata cash payment without documenting a loss. Pro rata here means remaining funds are divided equally among valid claimants who select this option. The amount is not specified yet and must not be mistaken for the $2,500 loss cap. The form prohibits selecting both cash options.

One year of CyEx Financial Shield Complete is a separate selection. It includes monitoring for financial fraud and identity theft and access to fraud-resolution support. Its $1 million financial-fraud insurance limit is policy coverage, not money automatically paid to class members. This differs from the original incident-response offer of 24 months of credit monitoring; the original notice's enrollment period is not this settlement's claim window.

The fund first pays approved attorney fees and costs, representative awards and administration expenses. Counsel request $1,182,000 in fees and litigation costs, plus $2,500 for each class representative. These are requests for court approval, not already awarded sums. Remaining money and valid claims determine available benefits.

The claim deadline is November 27, 2026. The opt-out and objection deadline is November 13, 2026. Opting out means leaving the settlement, forfeiting benefits and preserving any rights you have to pursue the covered claims separately. The notice requires an individual signed request with the case identifier and contact details; follow its full submission requirements.

Objecting means telling the court why you oppose the proposal while staying in the class. The notice requires filing with the clerk by November 13 and sending copies to the administrator and both sides' counsel. It also requires specified supporting information, including whether artificial intelligence was used to prepare the objection. Read the complete requirements; a general complaint or a settlement claim alone is not an objection.

The hearing is scheduled for December 14, 2026 at 10 a.m. Eastern Time via Zoom, subject to change. Check the official site for current arrangements. Remaining in the class binds you to the release if the settlement becomes final. A release gives up covered legal claims; doing nothing produces no benefits but can still surrender those rights.

The court will decide approval and requested awards. Simpluris will review claims and may ask for additional information. Distribution follows final approval and resolution of appeals; no payment date is promised. The cash estimate and the validity of any individual loss remain unresolved until administration progresses.

Do not assume a bank loss establishes its cause or class membership. Retain records, answer administrator questions and consult class counsel or your own lawyer about legal-rights choices. The official agreement contains the full release and allocation terms that this general-reader summary cannot replace.