A District Court judge in Washington has given final approval to a $5.6 million settlement in a data breach lawsuit against Receivables Performance Management, a Washington-based collection agency, which compromised the personal information of over 3.7 million individuals. The breach, which occurred in April 2021, involved a ransomware attack on the company’s servers.
The background: The data breach at RPM began with unauthorized access to the company’s servers in April 2021. One month later, a ransomware attack disrupted portions of its computer system. Following the incident, RPM disconnected its systems, rebuilt its servers, and engaged a third-party security firm to investigate. The investigation revealed that sensitive consumer data, including Social Security numbers, was accessible to unauthorized parties. The breach prompted RPM to notify affected individuals and advise them on steps to protect against identity theft.
- Class action lawsuits were filed against RPM, alleging negligence and failure to comply with industry standards and Federal Trade Commission guidelines. Plaintiffs accused RPM of inadequate security measures, insufficient warnings, and failure to monitor vulnerabilities. While denying wrongdoing, RPM ultimately agreed to the settlement to avoid prolonged litigation.
The settlement: Under the terms of the settlement, RPM will provide a $5.6 million non-reversionary fund, ensuring that all available funds will benefit class members. Affected individuals can file claims for the following:
- Documented Losses: Reimbursement for expenses related to identity theft, including fraud-related charges, credit monitoring costs, and other associated expenses.
- Time Reimbursement: Compensation of $25 per hour for up to four hours for time spent addressing the consequences of the breach.
- California Statutory Damages: California residents affected by the breach may claim a $50 statutory damages payment.
- Credit Monitoring Services: All settlement class members can access three years of three-bureau credit monitoring services, including identity restoration and up to $1 million in identity theft insurance.
