Merchant of Tennis data breach settlement ($685K, $45 or $15 cash)

The Merchant of Tennis, Inc. and two related companies, U.S. Merchants Financial Group, Inc. and U.S. Optical Merchants, Inc., have agreed to a $685,000 settlement over a February 2024 cyberattack that exposed names, addresses, Social Security numbers and driver's license numbers. Most class members are employees who will be paid automatically: about $45 if they lived in California at the time and about $15 if they lived elsewhere. Third-party truck drivers and delivery workers who served the companies must file a claim to get paid.

The case is Victor Estrada v. The Merchant of Tennis, Inc. et al., Case No. 24STCV09656, in the Superior Court of California, County of Los Angeles. Anyone in the class can also claim up to $2,000 in documented losses and two years of credit monitoring. Claims are due January 27, 2027. The defendants deny wrongdoing, and the court has not yet given final approval.

The defendants are The Merchant of Tennis, Inc.; U.S. Merchants Financial Group, Inc.; and U.S. Optical Merchants, Inc. The settlement materials refer to them together as The Merchant of Tennis. U.S. Merchants traces its roots to a Beverly Hills retail shop opened in 1979 and today provides packaging services, point-of-sale displays and storage products, with facilities in California and other states, according to its company history. It added its own Greenline truck fleet in 2004.

The plaintiff and class representative is Victor Estrada. The court appointed Joshua Swigart of Swigart Law Group APC and Ben Travis of Ben Travis Law, APC as class counsel. The defendants are represented by Freeman Mathis & Gary, LLP. Simpluris is the settlement administrator.

• On or around February 13, 2024: an unauthorized third party gained access to the companies' network and acquired certain files, according to the companies' September 2024 notice letter.
• April 16, 2024: Estrada filed the lawsuit in Los Angeles Superior Court.
• August 2, 2024: the companies' investigation concluded that personal information was in the affected records.
• September 3, 2024: the companies mailed notices and offered 12 months of credit monitoring. A sample was filed with the California Attorney General.
• Before October 2026: the parties settled after mediation with Rodney Max, and the court authorized notice.
• October 29, 2026: the administrator mailed postcard notices and published a press release.

The 2024 notice letter said the affected data varied by person and, across the whole dataset, included names, driver's license numbers, alien registration numbers, passport numbers, health information and Social Security numbers.

The lawsuit alleges that during the February 2024 cyberattack, files containing private information were accessed, exposing class members to the risk of identity theft. The settlement agreement says the defendants "expressly deny that they are legally responsible or liable" and settled to avoid the time, expense and uncertainty of continued litigation. The settlement is not an admission of wrongdoing.

The court authorized the notice and set a final approval hearing. It has not decided whether the defendants did anything wrong, and it has not yet approved the settlement or the requested fees. Payments will be made only if the court grants final approval and any appeals are resolved.

The court defined the class as "The individuals whose information was impacted by the Cybersecurity Incident." The agreement counts 20,299 class members based on the companies' records, including 11,043 Non-Employees and 7,583 people who were California residents at the time. In practice there are two groups:

• People who received a postcard. These are mainly employees on the companies' records. You are in the class and will be paid automatically.
• Non-Employees. If you worked for another company and provided trucking or delivery services for The Merchant of Tennis in or before February 2024, you may be in the class but did not get a postcard. You must file a claim.

Excluded are the defendants and their officers, directors and related companies, anyone who opts out, the judge and the judge's family and staff, and anyone who carried out the attack.

• If you received a postcard, you do not need to do anything to get the automatic cash payment. File a claim only to add credit monitoring, claim documented losses, or show you lived in California in February 2024 if your postcard went to an address elsewhere.
• If you are a Non-Employee driver or delivery worker, file a claim at USMSettlement.com by January 27, 2027. Without a claim you get nothing.
• Gather receipts or statements for any losses tied to the incident.
• Questions go to the administrator at (855) 444-5824 or info@USMSettlement.com.

The $685,000 fund first pays court-approved costs. Class counsel will ask for fees of $228,333.33, which is one-third of the fund, up to $20,000 in costs and a $2,500 service award. Administration is estimated at $53,972. What remains pays benefits:

• Cash payment: initially set at $45 for people who lived in California at the time of the incident and $15 for everyone else. The amounts rise or fall pro rata depending on claims, and the California payment always stays three times the other amount.
• Out-of-pocket losses: up to $2,000 per person for documented, unreimbursed losses from February 1, 2024, through January 27, 2027, such as fraud losses, credit freeze fees, ID replacement costs and postage. Personal statements alone are not enough proof.
• Credit monitoring: two years of CyEx Identity Defense with $1 million in financial fraud insurance, for anyone who files a claim.

Claimants can choose PayPal, Venmo, Zelle, a virtual prepaid card or a paper check. Money from uncashed checks would go to the Electronic Frontier Foundation, subject to court approval.

• December 28, 2026: deadline to opt out or object. Opt-out requests must be mailed and postmarked by this date.
• January 27, 2027: claim deadline, online or postmarked.
• March 30, 2027, at 10:30 a.m. Pacific: final approval hearing in Department 12, Superior Court of California, County of Los Angeles, 312 North Spring Street, Los Angeles.

If you stay in the class, you release claims about the incident against the defendants and related companies, including Greenline Transportation and parent companies. If you opt out, you get no settlement benefits but keep your right to sue on your own.

• Non-Employee: a class member who worked for a third party and provided trucking or delivery services for the defendants at or before the time of the incident.
• Pro rata: adjusted in proportion, so payments shrink if claims are high and grow if money is left.
• Cy pres: a charity or nonprofit that receives leftover settlement money.
• Service award: a payment to the class representative for bringing the case.
• Final approval hearing: the court hearing where a judge decides whether to approve the settlement.

The court will consider final approval on March 30, 2027. The date can change without further notice, so check the official site. If the settlement is approved and no appeals are filed, payments go out within about 35 days of the effective date, and checks expire 90 days after they are issued.

Settlement terms, dates and class counts come from the official website, long-form notice, claim form and settlement agreement. Incident dates and data types come from the companies' September 2024 notice letter. The preliminary approval order was not posted on the settlement site, so its exact date is not stated here. Final payment amounts will not be known until claims are counted.

Class Action Pulse is not a law firm or settlement administrator and does not guarantee eligibility or payment. This article is general information, not legal advice.