DecoPac Settles $400K Class Action Over 2024 Data Breach Impacting 2,860 Individuals
DecoPac Inc. has agreed to a $400,000 class action settlement following a December 2024 data breach that exposed the personally identifiable information (PII) of approximately 2,860 current and former U.S. employees, along with their spouses and dependents. The breach, disclosed on December 6, 2024, involved unauthorized access to sensitive data, including names and Social Security numbers.
Eligible class members—defined as U.S. residents whose PII was compromised—may submit claims for financial compensation or credit monitoring services. The settlement offers three options:
- Documented out-of-pocket losses: Up to $4,000 for unreimbursed expenses (e.g., bank fees, credit monitoring, or identity theft-related costs) incurred between December 6, 2024, and February 5, 2026.
- Flat cash payment: $95 for those without documented losses.
- Credit monitoring: Three years of services, including $1 million in identity theft insurance.
The $400,000 cash payment fund is capped; if claims exceed this amount, payouts will be distributed proportionally. Payments will be issued via PayPal, Venmo, Zelle, virtual prepaid cards, or paper checks.
The settlement also allocates up to $150,000 for attorneys’ fees, $5,000 for class representatives, and covers administration costs and credit monitoring expenses. Key deadlines include:
- Opt-out deadline: January 6, 2026
- Claim submission deadline: February 5, 2026
- Final approval hearing: March 16, 2026
Approved payments and credit monitoring enrollment codes will be distributed 75 days after final settlement approval or 30 days after claim approval, whichever is later.
The lawsuit alleged DecoPac failed to adequately safeguard PII, though the company denies wrongdoing and settled to avoid prolonged litigation. The breach’s impact remains under review as affected individuals pursue claims.
Source: https://www.claimdepot.com/settlements/dp-data-settlement
DecoPac, Inc. cybersecurity rating report: https://www.rankiteo.com/company/decopac-inc.
"id": "DEC1765392005",
"linkid": "decopac-inc.",
"type": "Breach",
"date": "12/2024",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"{'affected_entities': [{'customers_affected': '2,860 current and former '
'employees, and their spouses '
'and dependents',
'location': 'United States',
'name': 'DecoPac Inc.',
'type': 'Company'}],
'customer_advisories': 'Settlement notice sent to affected individuals with '
'claim instructions',
'data_breach': {'number_of_records_exposed': '2,860 individuals (employees, '
'spouses, dependents)',
'personally_identifiable_information': 'Names, Social '
'Security numbers',
'sensitivity_of_data': 'High (names, Social Security numbers)',
'type_of_data_compromised': 'Personally Identifiable '
'Information (PII)'},
'date_publicly_disclosed': '2024-12-06',
'description': 'DecoPac Inc. has agreed to pay up to $400,000 to settle a '
'class action lawsuit for alleged failures to protect consumer '
'PII, following unauthorized access to sensitive information, '
'including names and Social Security numbers. The data breach '
'impacted approximately 2,860 current and former DecoPac '
'employees, and their spouses and dependents.',
'impact': {'data_compromised': 'Personally Identifiable Information (PII), '
'including names and Social Security numbers',
'financial_loss': '$400,000 (settlement fund)',
'identity_theft_risk': 'High (exposure of SSNs and PII)',
'legal_liabilities': 'Class action lawsuit settlement'},
'investigation_status': 'Settled (class action)',
'post_incident_analysis': {'root_causes': 'Alleged failure to adequately '
'protect sensitive information'},
'references': [{'source': 'Class action settlement notice'}],
'regulatory_compliance': {'legal_actions': 'Class action lawsuit'},
'response': {'communication_strategy': 'Public disclosure on Dec. 6, 2024; '
'settlement notice to affected '
'individuals'},
'title': 'DecoPac $400K Data Breach Class Action Settlement',
'type': 'Data Breach'}