$2,300,000 Payout Incoming After Settlement Reached Over Massive US Data Breach Impacting 71,000+ Victims

The victims of a massive US data breach are set to receive their share of a multi-million-dollar settlement.

A court has issued the preliminary approval of a deal that awards a total of $2.3 million to the more than 71,000 victims impacted by a cybersecurity attack at Sysco, a major food distribution company.

The funds are for “all individuals who reside in the United States to whom Sysco sent notice of the cybersecurity event in or around May 2023.”

The data breach compromised personal information, including names, Social Security numbers, account numbers and other personal information that Sysco had for payroll purposes, such as phone numbers, addresses and email addresses.

Under the terms of the deal, the victims are entitled to up to $5,000 in documented losses due to the data breach, including costs to combat identity theft or as a result of identity theft, as well as an additional payment estimated to be between $100 and $200 but up to $599.

The lawsuit, filed by Sysco truck driver Joseph Trottier, accuses the company of failing “to take and implement adequate and reasonable measures to ensure that the PII (personally identifiable information) of Plaintiff and Class Members was safeguarded, failing to take available steps to prevent an unauthorized disclosure of data, and failing to follow applicable, required and appropriate protocols, policies and procedures regarding the encryption of data, even for internal use.”

The lawsuit says the stolen personal info “can be sold on the Dark Web.”

“Hackers can access and then offer for sale the unencrypted, un-redacted PII to criminals. Plaintiff and Class Members now face a lifetime risk of (i) identity theft, which is heightened here by the loss of Social Security numbers, and (ii) the sharing and detrimental use of their sensitive information.”

In a notice sent to the victims, Sysco had said that it learned in March 2023 that a “threat actor gained access to our systems without authorization and claimed to have acquired certain data.”

Generated Image: Midjourney