If you banked with Fairmont Federal Credit Union — or did business with someone who did — there is a reasonable chance your personal information was swept up in the data security incident the credit union publicly announced in 2025. A proposed class action settlement is now in front of a federal judge in West Virginia, and the claim window is open. As a mass tort attorney who regularly counsels West Virginians through data breach claims, I want to walk through what the settlement covers, who may be liable in cases like this, and the steps you should take to protect yourself.
What Happened
According to court filings and the court-authorized notice, unauthorized actors are alleged to have gained access to Fairmont Federal Credit Union’s network for roughly three weeks in late 2023. The credit union has stated it discovered the intrusion in January 2024, confirmed in the summer of 2025 that affected files held personal information, and began mailing notices to impacted individuals in September 2025.
A federal class action, Butler v. Fairmont Federal Credit Union, was filed in the Northern District of West Virginia in September 2025. Related cases filed in Marion County and Kanawha County circuit courts were later folded into the federal case. In March 2026, the court dismissed one claim (unjust enrichment) but allowed the balance of the case to move forward, and the parties reached a proposed settlement after mediation. The agreement calls for a non-reversionary common fund of roughly $1.78 million to resolve the claims of approximately 187,038 class members nationwide. The credit union denies the allegations, and no court has decided whether the credit union did anything wrong.
The final approval hearing is set for February 8, 2027 in Clarksburg. The deadline to file a claim, opt out, or object is December 18, 2026.
Who May Be Liable
In data breach cases like this one, the universe of potential defendants typically includes:
- The institution that held your data. A credit union, bank, hospital, or employer that collects sensitive personal and financial information may be alleged to have failed to use reasonable cybersecurity safeguards.
- Vendors and third-party IT contractors. If an outside service provider handled network security, cloud storage, or data processing, that company could be named in some cases.
- Executives or board members in rare cases where governance failures are alleged to have driven the lapse.
In the Fairmont FCU matter, the plaintiffs’ claims focus on the credit union itself. Fairmont FCU has denied wrongdoing, and liability has not been proven in court.
Legal Theories That May Apply
Most data breach class actions, including this one, rely on a familiar cluster of legal theories:
- Negligence. The institution allegedly owed a duty to protect sensitive information and failed to use reasonable care.
- Negligence per se. Where a company allegedly violated a statute or regulation designed to protect consumer data, that violation can serve as evidence of negligence.
- Breach of implied contract. Customers who hand over Social Security numbers and account data typically expect the institution to safeguard it; a failure to do so may be alleged to breach that implied promise.
- Breach of fiduciary duty. Financial institutions often hold a position of trust, and plaintiffs may allege that duty was violated when the data was not adequately secured.
- Unjust enrichment. Plaintiffs sometimes argue the company benefited from fees or business while cutting corners on security. (This claim was dismissed in Butler, but it remains common in similar cases.)
- State consumer protection statutes. West Virginia and surrounding states have unfair-trade-practice laws that may apply to misrepresentations about data security.
Damages Victims May Recover
In a data breach matter, the categories of recovery can include:
- Reimbursement of out-of-pocket losses such as fraudulent charges, bank fees, credit freeze costs, and expenses tied to identity theft.
- Compensation for lost time spent dealing with the fallout — monitoring accounts, disputing charges, replacing cards.
- Credit monitoring and identity theft insurance, often provided for a set number of years.
- Statutory damages where a specific state or federal statute authorizes them.
- Punitive damages in cases where the conduct is alleged to be especially reckless, though these are rarely available in a class settlement framework.
In the Fairmont FCU settlement specifically, class members who submit a valid claim may be entitled to three years of one-bureau credit monitoring with up to $1 million in identity theft insurance, plus a choice between (1) reimbursement of documented out-of-pocket losses up to $7,500 and attested lost time at $35/hour up to four hours, or (2) an alternative cash payment of up to $150, paid pro rata from whatever remains after other benefits and administrative costs.
Evidence That Strengthens a Case
Whether you are participating in a class settlement or considering an individual claim, the quality of your records matters. Useful evidence typically includes:
- The notice letter you received from the breached institution — keep the envelope and any Class Member ID.
- Bank and credit card statements showing suspicious or fraudulent activity.
- Credit reports showing new accounts, hard inquiries, or address changes you did not authorize.
- Receipts and invoices for credit freezes, identity restoration services, notarization, or postage related to the breach.
- IRS or state tax correspondence about returns filed in your name.
- A written log of time you spent dealing with the incident, with dates and tasks.
- Police reports or FTC identity theft affidavits if you were a fraud victim.
- Internal company documents and regulatory filings — these are usually obtained through litigation and may show what the institution knew about its security posture.
What to Do Next
If you believe you were affected by the Fairmont FCU breach or any similar incident in West Virginia, Ohio, Pennsylvania, Virginia, Kentucky, or Maryland, a few conservative steps go a long way:
- Preserve the notice letter and Class Member ID. The online claim form will not open without it.
- Pull your credit reports from all three bureaus and consider placing a free credit freeze.
- Document symptoms of identity theft — strange mail, unknown accounts, tax issues — as soon as you notice them.
- Keep receipts for every dollar you spend responding to the breach.
- Do not give recorded statements to insurers or company representatives without first speaking to a lawyer.
- Mind the deadline. For the Fairmont FCU settlement, claims, opt-outs, and objections are due by December 18, 2026.
- Decide whether to opt out. If you believe your losses significantly exceed what the settlement offers, opting out may preserve your right to sue individually — but that choice has consequences and should be discussed with counsel.
If you or a loved one has been harmed by negligence or wrongdoing in West Virginia, contact New Law Office in Beckley for a free, confidential consultation. We work on contingency — you pay nothing unless we win your case. Call (304) 355-5565 or visit newlawoffice.com to speak with our team.
Frequently Asked Questions
Am I automatically part of the Fairmont FCU settlement if I was a member?
If your private information was potentially impacted by the incident Fairmont FCU disclosed in 2025, you are likely included in the proposed class unless you opt out. The credit union has estimated the class at about 187,038 people, including current and former customers and certain individuals who transacted with them. You will not receive a payment, however, unless you submit a valid claim by the December 18, 2026 deadline.
What is the difference between the $150 cash option and the $7,500 reimbursement option?
The up-to-$150 alternative cash payment requires no documentation and is paid pro rata from whatever is left in the fund, so the actual amount could be lower. The documented-loss option can reimburse up to $7,500 in unreimbursed out-of-pocket losses, plus up to $140 in attested lost time, but you must provide reasonable third-party proof of each loss. You cannot combine the $150 cash option with the documented-loss and attested-time benefits.
Can I still sue Fairmont FCU on my own instead of taking the settlement?
Yes, but only if you properly opt out by the December 18, 2026 deadline. If you do not opt out, you will be bound by the release and will give up the right to sue Fairmont FCU over this incident — even if you never file a claim. Before opting out, it is wise to speak with an attorney about whether your losses justify an individual case.
What if I never received a notice letter but think I was affected?
Contact the settlement administrator, Kroll, through the official settlement website to ask about your status and your Class Member ID. If you believe you were a Fairmont FCU customer during the relevant period and should have been notified, keep records of your attempts to confirm your status. An attorney can also help you evaluate whether a separate claim may be available.
How long do I have to bring a data breach claim in West Virginia?
Statutes of limitations vary depending on the legal theory, but West Virginia’s general negligence statute is typically two years from the date of injury, and contract-based claims can run longer. Because data breach injuries can be hard to pin to a single date, deadlines are fact-specific. The safest step is to speak with a lawyer promptly rather than guess.
Does the settlement cover identity theft that happens after I file a claim?
The documented-loss benefit covers unreimbursed out-of-pocket losses incurred between September 30, 2023 and December 18, 2026, so losses after that window generally would not be reimbursed under this settlement. If you suffer identity theft tied to the breach after the claim period, your rights may be more limited once the release takes effect. This is one reason to carefully consider whether to opt out if you have ongoing concerns.
When will payments actually go out?
No payment date has been set. Checks, electronic payments, and credit monitoring activation codes will not be sent until after the court grants final approval — currently scheduled to be considered on February 8, 2027 — and until any appeals are resolved. Data breach settlements commonly take several additional months after that hearing before funds are distributed.
What should I do if I live in Ohio, Pennsylvania, Virginia, Kentucky, or Maryland and was affected?
The settlement class is nationwide, so residents of surrounding states are eligible to participate on the same terms as West Virginians. You will still need the Class Member ID from your notice to file online, and you can mail a paper claim form if you prefer. If you believe your losses are substantial, consult a lawyer licensed to assess your options under both the settlement and your home state’s consumer protection laws.
Original reporting: openclassactions.com.