University of St. Thomas Data Breach Class Action Settlement

Current and former students and other individuals who received a notice from the University of St. Thomas about a data breach that occurred between July 25, 2025, and Aug. 12, 2025, may be eligible to submit a claim for up to $5,100 and/or credit monitoring from a class action settlement. The ransomware incident impacted more than 26,000 people.

The University of St. Thomas agreed to settle a class action lawsuit alleging it failed to adequately protect private information. The complaint claimed unauthorized parties accessed files containing sensitive data, such as Social Security numbers, bank account details, credit card numbers, government ID information, logins and passwords, home addresses, email addresses, phone numbers, donor and club membership information, and other confidential records.

Who can file a claim for a data breach payout?

Class members are individuals residing in the United States who received a notice from University of St. Thomas stating the data breach that occurred between July 25, 2025, and Aug. 12, 2025, potentially compromised their personal information.

How much are settlement payments?

Class members have the following benefit options:

• Ordinary losses: Class members can claim up to $500 for documented out-of-pocket expenses related to the data breach. Eligible expenses include professional fees, such as attorneys' 'or accountants' fees, costs for credit repair services, costs to freeze or unfreeze credit, credit monitoring costs incurred between July 25, 2025, and Sept. 28, 2026, copy fees, notary fees, mileage and postage for contacting financial institutions.
• Extraordinary losses: Class members can claim up to $4,500 for documented, unreimbursed monetary losses resulting from fraud or identity theft that the breach most likely caused. Losses must have occurred after the data incident and must not be covered by other claims. The claimant must have exhausted all available credit monitoring or identity theft insurance.
• Losses related to sensitive personal information: Class members can submit a claim to receive a $100 cash payment if the breach disclosed sensitive personal information, such as employment files, disciplinary records or other private information. They must provide third-party documentation showing the data breach caused the disclosure.
• Alternative cash payment: Class members who do not submit an ordinary losses, extraordinary losses, losses related to sensitive personal information or credit monitoring claim can submit a claim to receive a $50 cash payment.
• Credit monitoring: All class members can elect to receive three years of one-bureau credit monitoring and identity theft protection services, which includes at least $1,000,000 in identity theft insurance.

How to claim a class action rebate

To receive a settlement payment, class members can file a claim online or print the PDF claim form to complete and mail to the settlement administrator.

Settlement administrator's mailing address: UST Data Settlement, P.O. Box 25226, Santa Ana, CA 92799

The claim deadline is Sept. 28, 2026.

Required proof and claim information

• All claimants must provide the login ID from the settlement notice they received. is required to submit a claim online. Online claimants must also provide the PIN from the same notice.
• Ordinary losses claims require supporting documentation, which may include receipts, invoices or other third-party documentation of expenses.
• Extraordinary losses require supporting documentation showing monetary losses, proof of identity theft or fraud, and evidence that the class member exhausted all available insurance or reimbursement options.
• Losses related to sensitive personal information claims require proof showing the data breach most likely caused the disclosure.

Payout options

• Paper check mailed to the address provided
• Electronic payment

Settlement fund

The settlement fund will include:

• Settlement administration costs: To be determined
• Attorneys' fees, costs and expenses: Up to $240,000
• Service award to class representative: Up to $4,000
• Credit monitoring: Cost determined by number of claims filed
• Payments to approved claimants: Total determined by number of valid claims filed

Important dates

• Opt-out deadline: Aug. 28, 2026
• Claim deadline: Sept. 28, 2026
• Fairness hearing: Date to be determined

When is the University of St. Thomas data breach settlement payout date?

The settlement administrator will issue payments to approved claimants within 30 days after it completes claim processing or approximately 90 days after the court grants final approval to the settlement, whichever is later.

Why did this class action settlement happen?

The class action lawsuit claimed unauthorized access to the University of St. Thomas network exposed sensitive personal information. The plaintiff alleged the university failed to adequately protect this information, leading to potential harm for those affected.

The University of St. Thomas denies the allegations but agreed to settle to avoid the expense and uncertainty of continued litigation.

Sources

1. Settlement website FAQ page
2. Class notice
3. Claim form
4. Settlement agreement