When a hometown financial institution reports that hackers took Social Security numbers, the worry does not end when the news cycle does. A proposed settlement involving Fairmont Federal Credit Union could affect a large number of people in north-central West Virginia and beyond. Many of them may not yet know they could qualify for compensation or protective services.
What Happened
According to reports, unauthorized intruders were inside Fairmont Federal Credit Union’s (FFCU) internal network for about three weeks, from September 30, 2023 through October 18, 2023. A later investigation reportedly found that the attackers copied personal data belonging to more than 187,000 people. The exposed information reportedly included names and Social Security numbers.
Affected individuals filed a class action in the U.S. District Court for the Northern District of West Virginia. They alleged that FFCU did not use reasonable security measures to protect the information it held. FFCU denied any wrongdoing or negligence. Both sides nonetheless agreed to resolve the case rather than continue costly and uncertain litigation.
Under the proposed agreement, FFCU would fund a $1.78 million settlement pool. That money is expected to cover class member claims, administration costs, attorneys’ fees and expenses, and any service awards the court approves. The court has granted preliminary approval, but the deal is not final. A final approval hearing is reportedly scheduled for February 8, 2027.
Who May Be Liable
In data breach cases, the primary defendant is usually the organization that collected and stored the sensitive information. Here, that is the credit union the plaintiffs sued. A settlement is not an admission of fault, and no court has found FFCU liable for anything.
In other breach cases, additional parties could be liable depending on the facts. These may include outside IT contractors, software vendors, or data-hosting companies whose systems or practices allegedly opened the door to an attack. The criminals who carried out an intrusion are responsible too, but they are rarely identified or able to pay. Nothing in the available reporting indicates that a vendor was involved in this incident.
Legal Theories That May Apply
Data breach lawsuits typically rest on several overlapping legal theories:
- Negligence: A company that collects sensitive data may owe a duty to use reasonable care in protecting it. Falling short of that duty could create liability for resulting harm.
- Negligence per se: Plaintiffs may argue that violating a data-security law or regulation, such as federal safeguarding rules for financial institutions, is itself evidence of carelessness.
- Breach of implied contract: Customers who must hand over personal information to open accounts may argue there was an unspoken promise to keep it safe.
- Unjust enrichment: This theory claims a business profited from customer relationships while allegedly underinvesting in the security customers reasonably expected.
- Invasion of privacy: Some claims allege that exposing private identifiers like Social Security numbers is an unreasonable disclosure of private facts.
- Inadequate or delayed notice: West Virginia, like other states, has a breach notification law. Where notice was allegedly late, plaintiffs may argue the delay left them unable to protect themselves.
Here is a key point. A class action bundles thousands of similar claims into one case. People with serious, well-documented losses can sometimes opt out and bring their own individual claims. That choice has deadlines and consequences, so it deserves careful review.
Damages Victims May Recover
According to reports, the proposed FFCU settlement offers eligible class members several possible benefits:
- Cash payment: An alternative cash payment of up to $150. The amount may be adjusted up or down depending on how many valid claims are filed.
- Credit monitoring and identity protection: Three years of single-bureau credit monitoring and identity restoration services, with up to $1 million in identity theft insurance.
- Out-of-pocket losses: Reimbursement of up to $7,500 for documented, unreimbursed losses reasonably traceable to the incident.
- Lost time: Up to four hours at $35 per hour, for a maximum of $140. This requires a written explanation of how the time was spent.
- Security improvements: FFCU has reportedly agreed to strengthen its cybersecurity, including employee training for five years.
Outside a class settlement, individual data breach claims may seek fraudulent charges that were never reimbursed, credit repair and monitoring costs, lost wages, and time spent fixing the damage. In some circumstances, they may also seek compensation for emotional distress. Punitive damages are possible only where conduct is shown to be especially reckless, and they are uncommon in breach cases. Federal courts also require proof of concrete harm, which is why documentation matters so much.
Evidence That Strengthens a Case
The strongest data breach claims are built on paperwork. Helpful evidence includes:
- The breach notification letter you received, and its date.
- Bank and credit card statements showing unauthorized activity.
- Credit reports showing accounts or inquiries you did not authorize.
- IRS letters about suspicious tax filings in your name.
- Police reports and identity theft reports filed with the Federal Trade Commission.
- Receipts for credit freezes, monitoring services, notary or mailing costs, and similar expenses.
- A written log of hours spent on phone calls, letters, and account fixes.
- Pay stubs or employer records showing time missed from work.
In litigation, attorneys may also seek the company’s forensic investigation findings, internal security policies, audit results, and regulatory filings through the discovery process.
What to Do Next
If you believe your information was involved, take these practical steps:
- Watch for the official notice. Settlement administrators typically mail or email notices. Use only the court-approved website or contact information listed in that notice, because scammers often imitate settlement communications.
- Note every deadline. Claim, opt-out, and objection deadlines are set by the court. Missing them can cost you your options.
- Freeze your credit. Freezes with Equifax, Experian, and TransUnion are free under federal law and are one of the best defenses against new-account fraud.
- Request an IRS Identity Protection PIN. It helps block fraudulent tax returns filed with your Social Security number.
- Document everything. Keep receipts, statements, and a time log starting now.
- Be cautious about signing anything. Before you release claims or accept a payment for significant losses, get advice from an attorney.
If you or a loved one has been harmed by negligence or wrongdoing in West Virginia, contact New Law Office in Beckley for a free, confidential consultation. We work on contingency – you pay nothing unless we win your case. Call (304) 355-5565 or visit newlawoffice.com.
Frequently Asked Questions
How do I know if I’m part of the Fairmont Federal Credit Union settlement?
The class generally includes people whose personal information was allegedly compromised in the 2023 incident, as defined in the court-approved notice. Many affected people receive a notice by mail or email. If you are unsure, contact the settlement administrator listed in the official notice rather than responding to unsolicited calls or messages.
Can I sue on my own if identity theft cost me thousands of dollars?
Possibly. Class members can usually opt out by a court-set deadline and pursue an individual claim, which may make sense if your documented losses are well above the settlement’s reported $7,500 reimbursement cap. An attorney can help you weigh that decision before the deadline passes.
How long do I have to file a claim?
The claim deadline is set by the court and should appear in the official settlement notice. The final approval hearing is reportedly scheduled for February 8, 2027. For lawsuits outside the settlement, West Virginia’s general two-year deadline for many injury claims may apply, but timing in breach cases can be complicated, so get advice early.
Do I need a lawyer to file a settlement claim?
No. Most class members can submit a claim form on their own through the official settlement website. A lawyer can be valuable, however, if you have major losses, are considering opting out, or want to object to the settlement terms.
What if my Social Security number was stolen but nothing bad has happened yet?
You may still be eligible for settlement benefits such as the cash payment option or credit monitoring, according to reports. Stolen Social Security numbers can be misused years later, so a credit freeze and an IRS Identity Protection PIN are wise precautions. Keep records of any time or money you spend protecting yourself.
Does the settlement mean the credit union admitted it was negligent?
No. FFCU denied any wrongdoing or negligence and agreed to settle to avoid the costs and risks of continued litigation. The settlement also is not final until the court grants final approval.
What if I live in Ohio, Virginia, or another nearby state?
In data breach settlements, eligibility usually depends on whether your information was affected rather than where you live today. Check the class definition in the official notice to confirm. Out-of-state residents may also want to ask a lawyer how their home state’s laws affect any individual claim.
Original reporting: teiss.co.uk.