Cadence Bank MOVEit Data Breach Class Action Settlement

If you were notified by Cadence Bank that your personal information was exposed in the MOVEit data breach, you may be eligible to receive up to $10,000 – plus two years of free credit monitoring.

Cadence Bank has agreed to a $5,250,000 class action settlement to resolve claims stemming from the May 2023 MOVEit file transfer breach. The settlement covers current and former customers whose personally identifying information was stored in files accessed during the breach.

Filing a claim takes only a few minutes. Most people qualify for at least the $100 alternative cash payment with no documentation required – and those who experienced identity theft or financial fraud may receive significantly more.

Who can file a claim?

To qualify for the Cadence Bank MOVEit data breach settlement, class members must meet both of the following criteria:

• US residency: You must be a person located in the United States.
• Notification by Cadence Bank: You must have been notified by Cadence Bank that your personally identifying information was included in files affected by the MOVEit data breach.

If you received a notification letter or email from Cadence Bank about the breach, you are almost certainly a class member. The settlement administrator used contact information from Cadence Bank records to identify eligible individuals.

How much can class members receive?

The Cadence Bank MOVEit data breach settlement offers four types of compensation depending on what you experienced and what documentation you can provide:

• Alternative cash payment ($100, no documentation required): Any class member can claim this flat payment. It is subject to pro rata adjustment and could increase up to $1,000 if fewer people file.
• Ordinary losses (up to $2,500): Covers documented out-of-pocket losses like bank fees, credit freeze costs, and up to 4 hours of lost time at $25 per hour. Receipts or bank statements required.
• Extraordinary losses (up to $10,000): Available if you suffered actual identity theft or fraud directly tied to the breach. Third-party documentation is required (police reports, fraud claims, etc.).
• Credit monitoring (no documentation required): Two years of three-bureau credit monitoring with $1,000,000 in identity theft insurance, available to all class members regardless of other claims.

You may file for the cash payment and credit monitoring simultaneously. The maximum combined payout is up to $10,000 plus two years of credit monitoring.

How to claim a data breach payment

You can submit your claim online or by mail. The online form is the fastest option and takes only a few minutes to complete.

• Online: Visit moveitcadencesettlement.com/form/claim and follow the instructions.
• By mail: Download and complete the PDF claim form, then mail it to the address below before June 4, 2026.

If you received a notice, have your Unique ID ready – it will pre-populate some fields. If you cannot find your notice, you can still file using your name and contact information.

What proof or documentation is necessary?

Documentation requirements vary by benefit tier:

• Alternative cash payment ($100): No documentation required. Simply complete the claim form.
• Credit monitoring: No documentation required.
• Ordinary losses: Supporting documents such as bank statements, receipts, invoices, or credit reports showing charges related to the breach.
• Extraordinary losses: Third-party documentation of actual fraud or identity theft, such as a police report, FTC Identity Theft Report, or financial institution fraud claim.

Even if you have no documents, filing for the $100 payment and free credit monitoring is worthwhile and requires no additional paperwork.

Payout options

The settlement does not specify a single payout method on its public claim form. The administrator, Simpluris, Inc., typically issues payments by check or digital transfer. Class members should confirm their preferred payment method when completing the claim form at the settlement website.

Settlement fund breakdown

The settlement fund covers:

When is the Cadence Bank settlement payout date?

No final payout date has been officially announced. Here is the current schedule of key dates:

• Claim deadline: June 4, 2026
• Exclusion deadline: May 5, 2026
• Fairness hearing: July 9, 2026

After the fairness hearing, the court must issue a final approval order. Once that order becomes final and any appeal period expires, the administrator distributes payments. Based on typical timelines in similar cases, checks or digital payments may arrive 3 to 6 months after the July 2026 hearing.

Class members should file before the June 4, 2026 deadline to secure their place in the settlement.

Why did this class action settlement happen?

The settlement arises from the May 2023 MOVEit data breach – one of the largest coordinated cyberattacks in US history. MOVEit Transfer is a managed file transfer application made by Progress Software. Hackers exploited a zero-day vulnerability in MOVEit between May 28 and May 31, 2023, accessing files stored by hundreds of organizations worldwide.

Cadence Bank used MOVEit to transfer files containing customer data. As a result, personally identifying information belonging to Cadence Bank customers was exposed during the breach. Plaintiffs alleged that Cadence Bank failed to implement adequate data security measures and did not act quickly enough to notify affected individuals.

Cadence Bank denies any wrongdoing. The parties agreed to settle to avoid the cost and uncertainty of continued litigation.

Is the Cadence Bank settlement legitimate?

Yes. The Cadence Bank MOVEit data breach settlement is a court-supervised class action proceeding in a federal district court. Here is why it is credible:

• Court oversight: The case is pending in the United States District Court for the District of Massachusetts under case number 1:23-cv-12996-ADB, consolidated within MDL No. 1:23-md-03083-ADB-PGL.
• Reputable administrator: Simpluris, Inc. is one of the country’s largest class action settlement administrators, having handled hundreds of federal cases.
• Official settlement site: The authorized website is moveitcadencesettlement.com, consistent with court-approved notices sent to class members.
• No upfront cost: Filing a claim is always free. Any site asking you to pay to file is not legitimate.
• Verified sources: The settlement agreement, class notice, and claim form are publicly available through the court record and the administrator’s document portal.

The MOVEit MDL involves hundreds of defendant companies and has been recognized by federal courts as a legitimate mass litigation. The Cadence Bank settlement is one of many individual settlements within this broader proceeding.

How much will I actually receive from the Cadence Bank settlement?

The exact amount depends on which tier you claim and how many people file. Here is a realistic breakdown:

• No-documentation filers ($100 tier): If many class members file, the amount could be reduced pro rata below $100. If fewer people file, it could rise toward $1,000. Based on participation rates in similar MOVEit settlements, a realistic estimate is $50 to $150.
• Ordinary loss claimants (up to $2,500): Claims supported by clear documentation are generally paid at face value up to the $2,500 cap, subject to fund availability.
• Extraordinary loss claimants (up to $10,000): These claims are reviewed individually. Strong third-party documentation substantially improves the likelihood of a full or near-full payout.
• Credit monitoring: This benefit is not cash – it is a two-year service valued at roughly $200 to $400 at retail rates, with $1,000,000 in identity theft insurance.

The $5,250,000 fund is a hard cap. Attorneys take up to 33%, leaving roughly $3.5 million for class members after fees, administration, and the service award. Final individual amounts depend on total valid claims filed.

What actually happened in the Cadence Bank data breach?

The breach originated with a zero-day SQL injection vulnerability in Progress Software’s MOVEit Transfer application. Here is a factual timeline:

• Discovery of the vulnerability: Progress Software disclosed the vulnerability on May 31, 2023, after it had already been actively exploited.
• Attack window: The hacker group known as CL0P (also written Clop) began exploiting the vulnerability between May 28 and May 31, 2023, stealing data from thousands of organizations before patches were applied.
• Cadence Bank’s exposure: Cadence Bank used MOVEit to transfer customer data files. During the attack window, files containing personally identifying information of Cadence Bank customers were accessed without authorization.
• Data exposed: Exposed information may include names, Social Security numbers, account numbers, and other financial identifiers, depending on what was stored in the affected files.
• Notification: Cadence Bank subsequently notified affected customers by mail, as required under state data breach notification laws.

The MOVEit breach is considered one of the most widespread data theft incidents in history, affecting more than 1,000 organizations and tens of millions of individuals globally.

Why do companies settle data breach lawsuits even when they deny wrongdoing?

Settlement is almost always the rational outcome for both sides in data breach litigation. Several factors drive this:

• Litigation cost: Data breach class actions involve years of discovery, expert witnesses, and appeals. Legal fees for both sides can easily exceed the settlement amount.
• Uncertain jury outcomes: Even a strong defense carries risk. A jury verdict against the defendant could result in damages far exceeding a negotiated settlement.
• Reputational risk: A public trial forces companies to disclose internal security practices and communications, creating ongoing reputational damage regardless of outcome.
• Class certification pressure: Once a class is certified by a federal court, settlement becomes significantly more attractive because the potential liability multiplies across thousands of claimants.
• Denial preserved: Settlement agreements typically include a provision stating that the defendant does not admit liability. This allows the company to resolve the case without creating legal precedent.

In the case of the Cadence Bank MOVEit data breach settlement, the $5,250,000 fund reflects a negotiated resolution that allows Cadence Bank to close the matter while providing meaningful compensation to affected customers.

Sources

1. Class Notice – Simpluris / MDC2
2. Claim Form – Simpluris / MDC2
3. Settlement Agreement – Simpluris / MDC2
4. Benefits Plan – Simpluris / MDC2
5. Settlement Website FAQ – moveitcadencesettlement.com

Settlement Summary

Frequently Asked Questions