Union Bank and Trust Settles $2.39M Over 2023 MOVEit Data Breach
Union Bank and Trust Co. has agreed to a $2.39 million settlement to resolve a class action lawsuit stemming from a 2023 MOVEit Transfer software breach that exposed the personally identifiable information (PII) of 207,824 individuals. The cyberattack occurred between May 27 and May 31, 2023, exploiting a vulnerability in the file-transfer tool.
Who Is Eligible?
Current and former U.S. customers who received a breach notification from Union Bank and Trust may file a claim. Affected individuals can seek compensation for:
- Ordinary losses (up to $2,500) covering bank fees, credit monitoring costs, and up to four hours of lost time at $25/hour.
- Extraordinary losses (up to $10,000) for documented fraud or identity theft expenses incurred between May 31, 2023, and July 21, 2026.
- Alternative cash payment ($100 pro rata) for those who do not submit loss claims.
- Credit monitoring two years of three-bureau monitoring, dark web surveillance, $1 million identity theft insurance, and fraud resolution services.
Claim Process & Deadlines
Eligible individuals must file a claim by July 21, 2026, using their claimant ID and password from the settlement notice. Claims can be submitted online or via mail to the settlement administrator. Required documentation includes receipts, bank statements, or police reports for loss claims.
Payments will be distributed via PayPal, Venmo, Zelle, or paper check after the court grants final approval. The fairness hearing is scheduled for August 6, 2026, with the opt-out deadline set for June 22, 2026.
Settlement Fund Breakdown
The $2.39 million fund will cover:
- Settlement administration costs (TBD)
- Attorneys’ fees (up to $796,659)
- Attorneys’ expenses (pending court approval)
- Service awards (up to $2,500 for class representatives)
- Credit monitoring costs (based on claims filed)
- Remaining funds for approved claimants
Background & Legal Outcome
The lawsuit alleged that Union Bank and Trust failed to secure customer data, leading to the breach. While the bank denied wrongdoing, it settled to avoid prolonged litigation. The incident highlights the risks of third-party software vulnerabilities in financial data protection.
Source: https://www.claimdepot.com/settlements/ubt-data-settlement
Progressive Bank cybersecurity rating report: https://www.rankiteo.com/company/progressive-bank
"id": "PRO1777312132",
"linkid": "progressive-bank",
"type": "Vulnerability",
"date": "5/2023",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '207,824',
'industry': 'Financial Services',
'location': 'United States',
'name': 'Union Bank and Trust Co.',
'type': 'Bank'}],
'attack_vector': 'Third-party software vulnerability',
'customer_advisories': 'Breach notifications sent to affected individuals '
'with claim instructions',
'data_breach': {'number_of_records_exposed': '207,824',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': 'Personally identifiable '
'information (PII)'},
'date_detected': '2023-05-31',
'description': 'Union Bank and Trust Co. has agreed to a $2.39 million '
'settlement to resolve a class action lawsuit stemming from a '
'2023 MOVEit Transfer software breach that exposed the '
'personally identifiable information (PII) of 207,824 '
'individuals. The cyberattack occurred between May 27 and May '
'31, 2023, exploiting a vulnerability in the file-transfer '
'tool.',
'impact': {'brand_reputation_impact': 'Negative impact due to alleged failure '
'to secure customer data',
'data_compromised': 'Personally identifiable information (PII)',
'financial_loss': '$2.39 million settlement',
'identity_theft_risk': 'High (207,824 individuals affected)',
'legal_liabilities': 'Class action lawsuit settlement',
'systems_affected': 'MOVEit Transfer software'},
'investigation_status': 'Settled',
'lessons_learned': 'Highlights the risks of third-party software '
'vulnerabilities in financial data protection',
'post_incident_analysis': {'root_causes': 'Third-party software vulnerability '
'(MOVEit Transfer)'},
'references': [{'source': 'Settlement notice'}],
'regulatory_compliance': {'legal_actions': 'Class action lawsuit'},
'response': {'communication_strategy': 'Breach notifications sent to affected '
'individuals',
'enhanced_monitoring': 'Credit monitoring and dark web '
'surveillance offered to affected '
'individuals'},
'title': 'Union Bank and Trust MOVEit Data Breach Settlement',
'type': 'Data Breach',
'vulnerability_exploited': 'MOVEit Transfer software vulnerability'}