What $5.5 million buys when a million Social Security numbers walk out the door
Roughly a million Americans had their names, mailing addresses, financial account numbers, and Social Security numbers (SSNs) removed from a computer network belonging to a company most of them had never heard of. Their credit unions knew Doxim well enough to hand over member data for document management and customer communications, which is how a vendor in Markham, Ontario ended up holding the raw material for a million potential identity thefts. If a federal judge in Detroit signs off on October 28, 2026, the whole affair concludes with a $5.5 million settlement and little public comment.
The case is In re Doxim, Inc. Data Security Incident Litigation in the Eastern District of Michigan. If you run a vendor program, the details get worse as you read further.
The incident, and the very long walk to a notification letter
Doxim says it detected the intrusion on December 30, 2023, on the network segment supporting its credit union services business. The original complaint, filed June 13, 2024 on behalf of plaintiff Jonathan McKinley, alleges that the exfiltrated file set created a lifetime identity theft problem because the data is static. A credit card gets cancelled. Your Social Security number doesn’t.
“By implementing and maintaining reasonable safeguards and complying with standard data security practices, Defendant could have prevented this Data Breach.”
That’s the complaint talking, and the settlement denies all of it. Still, the pleaded timeline matters for anyone who runs a vendor program, because plaintiffs built something juries can hold in their heads.
- December 30, 2023. Doxim detects suspicious activity and finds files were removed.
- May 31, 2024. The first individual notification letters go out.
- July 5, 2024. The last ones arrive, according to the amended consolidated complaint.
That’s five to six months between detection and notification, and every month shows up in the filings as a negligence allegation. Plaintiffs also measured Doxim against the National Institute of Standards and Technology (NIST) Cybersecurity Framework version 1.1 and the Center for Internet Security (CIS) Critical Security Controls, arguing the company fell short of the benchmarks in its own industry.
Your vendor’s breach is your class action
How the credit unions ended up in the caption
The first complaint named Doxim alone. Six months and several consolidations later, the amended complaint added three of Doxim’s credit union clients as defendants. Credit Union ONE, Beacon Credit Union, and AmeriCU Credit Union found themselves facing new claims for breach of fiduciary duty and breach of contract on a third-party-beneficiary theory.
The theory was that the credit unions had told their members that security was a top priority, then, according to the plaintiffs, failed to ensure Doxim implemented reasonable safeguards before shipping over member data with SSNs attached. That gap between what you promise your customers and what you verify at your vendor is where these claims attach.
The fallout didn’t stay inside Doxim’s walls. Truliant Federal Credit Union and Financial Plus Credit Union had to send their own breach notices to members, explaining that a vendor they had contracted with was the source. When your incident response plan involves waiting on another company’s forensics team, you’ve discovered an uncomfortable dependency in your operating model.
The defendant who vanished
AmeriCU appeared in the December 2024 amended complaint but is absent from the settlement’s official defendant list, and the docket shows two voluntary dismissals in 2025. Why one credit union exited while two others settled isn’t explained in anything public. The answer probably lives in a contract somewhere, which is where answers like this usually stay.
The settlement, in numbers
Judge Terrence G. Berg granted preliminary approval June 5, 2026, after a full-day mediation with Jill R. Sperber of Judicate West. The mechanics:
| Option | What consumers get | What it takes |
|---|---|---|
| Cash Payment A | Up to $5,000 | Receipts documenting your losses |
| Cash Payment B | Estimated $100 | The claim form, nothing more |
| Credit monitoring | One year of one-bureau monitoring with dark web scans and $1 million identity theft insurance | File a claim |
Claims close October 13, 2026, online by 11:59 p.m. Eastern or postmarked that day, so for anyone reading this after publication, the window is effectively shut. The fund itself is $5.5 million and non-reversionary, so whatever class members don’t claim goes to the Michigan State Bar Foundation rather than back to the defendants.
Engagement has been, charitably, thin. Per the fee motion, 14 class members opted out, and the lone objection appears to have been filed by someone trying to leave the class.
Then there’s the money. Class counsel seeks $1,833,333.33, one-third of the fund, plus up to $50,000 in costs, along with $2,500 service awards for each of six class representatives. If Payment B lands near its $100 estimate, a class member whose SSN and bank account number were exfiltrated collects about a hundred bucks and 12 months of one-bureau monitoring. One caveat on the headline math; that $5.19 per person spreads the fund across everyone notified, before fees and before the claims rate concentrates the actual money on the roughly 4 percent who filed. The people who submitted claims receive considerably more than the people who didn’t.
The money nobody can see
When a public company or a non-profit settles a breach, it’s pretty easy to compare the settlement against quarterly revenue and then file it under cost of doing business. Doxim is private, majority-owned by private equity firm GI Partners since 2018, and publishes no audited financials. Third-party estimators scatter its revenue anywhere from roughly $83 million to $250 million, a range so wide it’s useless as a denominator. Anyone who tells you this settlement equals some percentage of Doxim’s revenue is doing math on a number they invented.
What’s verifiable is the shape of the operation. Around 700 employees, more than 1,500 clients in regulated industries across North America, and custody of the most identity-damaging data categories that exist. Whether $5.5 million registers as a rounding error or a genuine loss in Doxim’s books, nobody outside the company can say.
What an institution should take from this
The lessons survive the settlement’s denials of wrongdoing, and none of them require guessing what a jury would have done.
- Vendor diligence is litigation surface. The claims against the credit unions rested on the distance between their public security promises and their private vendor oversight. Everything your institution says publicly about protecting member data becomes pleading material when a vendor leaks it.
- Notification service level agreements are security controls. Half a year from detection to last letter is the fact pattern plaintiffs built the negligence claims around. Vendor contracts that treat notification timing as an afterthought hand opposing counsel a ready-made exhibit.
- Exits can be silent. AmeriCU left this case with no public explanation of how or why. If a vendor handling your member data gets dismissed from consolidated litigation, nothing in the court file tells you either, which is a strong argument for a mutual litigation-notice clause in every vendor contract you sign.
The final approval hearing is set for October 28, 2026, in Courtroom 709 of the Theodore Levin Courthouse in Detroit. Barring surprises, Judge Berg approves the settlement, the leftover fund goes to a bar foundation, and roughly a million people resume being vaguely aware that their SSN is floating around somewhere.
The question for your board is which role you’d play if your primary data processor got breached tomorrow. Would you be Doxim, settling at five dollars a head, or Credit Union ONE, sharing a caption and a fund with the vendor you picked? Either answer changes how you read the next vendor contract that crosses your desk.
