Kimco Staffing data breach settlement

Kimco Staffing Services, Inc. has agreed to a proposed resolution of litigation about a June 24, 2023 cyberattack. Its court-authorized notice provides a $640,000 common fund and identifies $400,000 in separate security enhancements. The combined $1.04 million figure does not mean that all of it will be distributed as claimant cash.

The long notice sets December 15, 2026 for claims. Eligible people can seek documented losses up to $5,000, a $50 California benefit, an equal share of remaining cash and two years of monitoring. Amounts and delivery depend on valid claims, available funds, court approval and finality. Two date discrepancies in the current official materials are identified below.

Kimco is an employment staffing company. Its website connects people seeking work with employers needing workers. The case concerns information held in that relationship.

The proceeding is Kimco Staffing Data Breach Cases, Judicial Council Coordination Proceeding No. 5321, in Orange County Superior Court. Judge Melissa R. McCormick oversees it. Coordination permits related California cases to be managed together. The reviewed public notice and FAQ do not name the individual class representatives, so this article does not invent their identities.

The notice names John J. Nelson of Milberg Coleman Bryson Phillips Grossman PLLC and Jason M. Wucetich of Wucetich & Korovilas LLP as class counsel. They represent the settlement group. Kroll Settlement Administration LLC runs the claims process. The Travelers Companies, Inc. is identified as Kimco's insurer in the release, not as the staffing company, claim administrator or another alleged attacker.

The court-authorized long notice describes allegations that unauthorized individuals entered Kimco's network around June 24, 2023, potentially accessing or extracting private information belonging to approximately 69,687 people. It says affected people received incident notices around December 2023.

A company-authored sample incident notice, hosted by California's attorney general, describes unauthorized access to a limited number of systems. Kimco said it could not confirm specific affected data because relevant data was unavailable, and that names and Social Security numbers may have been involved. The sample said information varied by person and that the company then had no evidence of misuse. Hosting that letter does not mean the attorney general decided Kimco was liable.

The public settlement materials reviewed do not establish exact complaint-filing, coordination, mediation or agreement-signature dates. The verified chronology covers the incident, notification and current claims process. The current notice schedules final review for February 18, 2027.

Plaintiffs allege cybercriminals accessed or extracted personally identifiable information, including names, Social Security numbers, financial-account information and payment-card information. Extraction means taking data out of the affected environment. Those are litigation allegations, not proof that every listed item was exposed for every class member.

Kimco denies wrongdoing and liability. The notice says neither the court nor another judicial body has determined that Kimco did anything wrong. Both sides agreed to settle to avoid trial costs, risks and related appeals; class representatives and their lawyers consider the proposal beneficial to the group. That assessment does not establish a guaranteed recovery for an individual.

Kimco's stated response includes security changes that it attributes substantially to the litigation or settlement. The notice describes network monitoring, vulnerability management, email protection, disaster recovery, increased security testing and policy and equipment updates. The $400,000 cost is separate from the fund; effectiveness was not independently audited.

The court authorized the long notice and appointed class counsel. Notice authorization allows affected people to learn about the proposal and exercise rights. It does not decide the underlying allegations or finally approve payments.

No signed final approval order was verified. The current official materials state that final approval remains to be decided. The library's preliminary-order and agreement PDFs could not be fully retrieved. This summary relies on the complete long notice and official FAQ, not every filed attachment.

The group covers individuals residing in the United States whose private information was exposed in the incident, including those sent notice and identified among the 69,687 affected people. Merely working through Kimco does not establish inclusion. Kroll can help resolve membership questions through 833-876-1553 or info@KimcoDataSettlement.com.

The qualification rows summarize exclusions; consult the long notice for its exact entity relationships.

California residence on June 24, 2023 matters for the separate California benefit, not for every national-class benefit. The California payment and monitoring do not require loss receipts; valid claims remain necessary. The full online claim form was not independently inspected, so confirm any notice-code or identity requirements in the current instructions.

Use the filing links at the official settlement website or obtain its paper claim form. Read the instructions, select qualifying benefits and complete the required certification. Do not send a payment request to the court or assume that submitting a Class Action Pulse inquiry completes a Kroll claim.

For expense reimbursement, provide third-party receipts, bills or statements and a description where the loss is not obvious. The long notice requires an actual, unreimbursed loss fairly traceable to the incident and reasonable efforts to avoid or recover it, including available monitoring or identity-insurance recovery. Handwritten records alone are insufficient, although they can explain independent documents.

The long notice uses June 24, 2023 through December 15, 2026 for actual misuse or fraud losses. The official FAQ instead states December 16. This article does not promise that December 16 expenses qualify. Ask Kroll about that discrepancy rather than postponing a December 15 claim. Keep confirmation and notify Kroll of later address changes.

The notice permits any or all qualifying benefits. Documented-loss reimbursement has a $5,000 ceiling. Examples include incident-related bank fees, usage-based communication charges, postage, local travel and monitoring costs. Kroll determines whether the connection is reasonable. Reimbursement can be reduced proportionally if funds are insufficient.

The $50 California benefit applies to qualifying residents on the incident date and may accompany other benefits. Equal-share cash is calculated only after approved fees, expenses, administration, monitoring, losses and California payments. No verified residual amount per person is available.

Every valid claimant for any benefit receives access to two years of monitoring and identity protection, including a $1 million identity-theft insurance limit and access to fraud-resolution agents. Insurance coverage is not a million-dollar award. The 2023 notice's one-year monitoring offer is separate; its enrollment terms do not govern this benefit.

The $640,000 non-reversionary fund does not return unused settlement cash to Kimco under the described structure. Class counsel may request up to $213,333.33 in fees plus up to $45,000 in expenses. Administration is capped at $97,000, and representatives may receive service awards up to $2,500 each if approved. These and monitoring costs reduce what remains; the separate $400,000 security spending does not enlarge the cash distribution pool.

The long notice, official date panel and filing FAQ use December 15, 2026 for online claims or paper postmarks. One homepage sentence says December 16. This article follows the long notice's December 15 instruction and discloses the inconsistency; relying on the later sentence could put a claim at risk.

Opt-outs and objections must be emailed or mailed with a postmark by November 16, 2026. Use the official forms and detailed notice. Exclusions require an individual physical or authenticated digital signature. Objections require contact and membership information, grounds and supporting law, lawyer and appearance details, prior-objection history and a signature.

The notice schedules final review for February 18, 2027 at 2 p.m. Pacific in Department CX105. Confirm the date and attendance arrangements because they may change. Attendance is not required merely to file a benefit claim.

Opting out forfeits settlement benefits but preserves the described independent legal rights. Objecting remains within the class. Doing nothing yields no benefit but can still release covered claims against Kimco, its employees and insurer if the settlement becomes final. A release surrenders specified claims; consult counsel if its scope affects another action.

Pro rata here means an equal share of remaining money among approved claimants. Non-reversionary describes money not returning to the defendant under the settlement structure. CCPA refers to the California Consumer Privacy Act, the label the notice uses for the California payment; the label is not a finding that Kimco violated that statute. Final approval is the court's acceptance of the proposal after review, separate from notice authorization.

Kroll receives and evaluates claims, and the court considers fairness, objections and fee and service-award requests. Payments require approval and resolution of any appeals. The notice warns that appeals and processing can take substantial time; no specific payout date was verified. The hearing date is not the payout date.

The court-authorized notice mirror is cross-checked with the official FAQ. The company letter supports incident statements, not settlement terms. Date discrepancies are disclosed; no final order, residual award or unverified procedural date is inferred. Class Action Pulse is not a law firm or settlement administrator and does not guarantee eligibility or payment.