1. What is the Notice, and why did I get it?
2. What is this lawsuit about?
3. Why is this a class action?
4. Why is there a settlement?
5. How do I know if I am part of the Settlement?
6. What does the Settlement provide?
7. How do I file a claim for Undocumented Losses or Harms or Out-of-Pocket Losses?
8. How will claims be decided?
9. When will I get my payment?
10. What am I giving up as part of the Settlement?
11. Do I have a lawyer in this case?
12. How will the lawyers be paid?
13. How do I exclude myself from the Settlement?
14. How do I tell the Court that I like or do not like the Settlement Agreement?
15. How do I get more information?
A Court authorized notice to inform you how you may be affected by this proposed Settlement. The Notice describes the lawsuit, the general terms of the proposed Settlement, and what it may mean to you. The Notice also explains how to participate in, or exclude yourself from, the Settlement.
For information on how to determine if you are a Settlement Class Member, and therefore eligible for benefits under this Settlement, see FAQ 5.
Back To Top
On February 13, 2023, TMX detected suspicious activity on its systems and promptly took steps to investigate the incident. As part of that investigation, global forensic cybersecurity experts were retained. Based on the investigation, the earliest known breach of TMX’s systems started in early December 2022, and information may have been acquired between February 3, 2023, through February 14, 2023. TMX promptly reported and provided notice of the data security incident (i.e., the Data Breach).
The lawsuit claims that TMX is responsible for the Data Breach. Plaintiffs allege, among other things, that TMX failed to take reasonable steps to safeguard and protect certain data, including Personal Information. Plaintiffs assert a variety of common law and statutory claims, including claims for negligence, negligence per se, unjust enrichment, breach of bailment, invasion of privacy/intrusion upon seclusion, declaratory and injunctive relief, and for alleged violations of certain consumer protection statutes. Plaintiffs seek to recover actual damages, statutory damages, punitive damages, and attorneys’ fees, in addition to equitable relief. Plaintiffs purport to bring these claims on behalf of a nationwide class and various state-specific subclasses of individuals whose Personal Information was purportedly compromised by the Data Breach. TMX denies all material allegations in the Consolidated Complaint and specifically denies that it failed to properly protect any data or Personal Information, had inadequate data security, was unjustly enriched, breached any duty or implied contract, or violated any state consumer protection statutes or other laws.
No court or other judicial entity has made any judgment or other determination of any wrongdoing by TMX. The Settlement was reached before the Court ruled on TMX’s motion challenging Plaintiffs’ Consolidated Complaint and TMX’s motion to compel arbitration, and before the Parties engaged in formal discovery (including the production of documents and presentation of witnesses for deposition). If litigation had continued, each party would have offered expert witnesses to testify as to whether TMX’s cybersecurity program was reasonable and whether Plaintiffs could prove damages on a class-wide basis. TMX would also likely move for summary judgment, arguing that the undisputed evidence proves that Plaintiffs’ claims would fail. Motion practice and discovery would create significant uncertainty as to whether Plaintiffs would be able to continue to assert claims on behalf of the proposed classes and whether Plaintiffs or TMX would ultimately prevail in the litigation.
Back To Top
In a class action, one or more people called “Class Representatives” sue on behalf of themselves and other people with similar claims. All of these people together are the “Class” or “Class Members.” Because this is a class action settlement, even persons who did not file their own lawsuit can obtain benefits provided under the Settlement, except for those individuals who exclude themselves from the Settlement class by the deadline.
Back To Top
The Court has not decided in favor of Plaintiffs or TMX. Instead, both sides agreed to a settlement after a lengthy mediation process overseen by a neutral mediator. Settlements avoid the costs and uncertainty of a trial and related appeals, while more quickly providing benefits to members of the Settlement Class. The Settlement Class Representatives appointed to represent the class and the attorneys for the Settlement Class (“Class Counsel,” see FAQ 11) believe that the Settlement is in the best interests of the Settlement Class Members.
Back To Top
You are a Settlement Class Member if your personal information was accessed, stolen, impacted, or compromised as a result of the Data Breach as identified in the Class List. If you are not sure whether you are included in the Settlement, you may call 1-833-296-0855 or info@TMXDataSecuritySettlement.com with questions.
Back To Top
The Settlement provides:
Compensation for undocumented losses and harms;
Compensation for documented, unreimbursed, out-of-pocket losses;
Debt reduction for Settlement Class Members and Settlement Class Representatives;
Payment of costs of notifying Settlement Class Members and administering the Settlement;
Payment of Attorneys’ Fees and Expenses, as approved by the Court (see FAQ 12); and
Injunctive relief, including a number of security commitments by TMX designed to prevent attacks similar to the Data Breach from occurring in the future.
Settlement Benefit: Undocumented Losses or Harms. Settlement Class Members may submit a claim to receive $35.00 (thirty-five dollars) for losses or harm that they attest is fairly traceable to the Data Breach, including: for time spent responding to issues related to the Data Breach, loss of your personal information, emotional distress, and/or any other alleged losses or harms related to the Data Breach. No documentation of such losses or harm is required to claim this benefit.
This is a claims-made benefit subject to an aggregate cap of $4,500,000.00 (four million five hundred thousand dollars). If the aggregate total of claims for undocumented losses or harms exceeds $4,500,000.00 (four million five hundred thousand dollars), there will be a pro rata reduction such that the total amount paid by TMX does not exceed $4,500,000.00 (four million five hundred thousand dollars). In no event will TMX be required to pay more than $4,500,000.00 for Undocumented Losses or Harms.
Settlement Benefit: Documented Out-of-Pocket Losses. Settlement Class Members may submit claims for up to $500.00 (five hundred dollars) for documented monetary loss that is fairly traceable to the Data Breach and that has not already been reimbursed, including, but not limited to: (i) out-of-pocket costs, expenses, losses, or other charges incurred as a result of identity theft or identity fraud, falsified tax returns, or other possible misuse of a Settlement Class Member’s Personal Information; (ii) out-of-pocket costs incurred after the Data Breach was disclosed associated with changing accounts or engaging in other mitigative conduct, including but not limited to notary, fax, postage, copying, mileage, and long-distance telephone charges; (iii) out-of-pocket professional fees incurred to address the Data Breach; and (iv) out-of-pocket purchases of credit monitoring or other mitigative services after the Data Breach was disclosed, through the date of the Settlement Class Member’s Claim submission.
This is a claims-made benefit subject to an aggregate cap of $2,000,000.00 (two million dollars). If the aggregate total of claims for documented out-of-pocket losses exceeds $2,000,000.00 (two million dollars), there will be a pro-rata reduction such that the total amount paid by TMX is $2,000,000.00 (two million dollars). In no event will TMX be required to pay more than $2,000,000.00 for Documented Out-of-Pocket Losses.
Note that you may submit a claim for both Undocumented Losses or Harm and Documented Out-of-Pocket Losses.
Settlement Benefit: Debt Reduction for Settlement Class Members who do not submit an approved Claim.All Settlement Class Members who do nothing or submit a claim for monetary benefits (i.e., a claim for Undocumented Losses or Harms and/or Documented Out-of-Pocket Losses) that is not approved by the Settlement Administrator, will automatically receive a one-time credit of $20 applied to an outstanding balance owed by them as reflected in the Settlement Class Member’s account with TMX Finance LLC subsidiaries. If a Settlement Class Member owes less than $20, the Settlement Class Member’s account will be reduced to $0.00. No cash payment will be made in connection with this benefit.
Settlement Class Representatives Debt Reduction. In exchange for the Settlement Class Representatives’ general release and mutual covenant not to sue provided in the Settlement, all Settlement Class Representatives to the extent they have an outstanding balance owed as reflected in the Settlement Class Members’ accounts with TMX Finance LLC’s subsidiaries, will have their debt as of the Effective Date reduced to $0.00. For the avoidance of doubt, no cash payment will be made in connection with this benefit. The aggregate total of such debt reduction for all Settlement Class Representatives shall be limited to $200,000.00 (two hundred thousand dollars).
The Settlement Administrator will decide if your claim for Undocumented Losses or Harms or Documented Out-of-Pocket Losses is valid. Only valid claims will be paid. The deadline to file a claim for Undocumented Losses or Harms or Documented Out-of-Pocket Losses is August 6, 2025. The amount of your claim may be reduced depending on the total amount of claims.
Back To Top
To file a claim for Undocumented Losses or Harms, or Documented Out-of-Pocket Losses, you will need to file a Claim Form. Claim Forms can be submitted online with your Unique ID and PIN, which can be found on the postcard notice or email you received or by contacting the Settlement Administrator.
You can also download a paper claim form here, and return a completed claim form by mail addressed to:
TMX Data Settlement
c/o Settlement Administrator
P.O. Box 25043
Santa Ana, CA 92799
The easiest way to submit a claim form is online, by filling out the form here.
You can also call the Settlement Administrator at 1-833-296-0855 and request that a claim form be mailed to you.
The deadline to file a claim is August 6, 2025 (this is the last day to file online and the postmark deadline for mailed claims).
Back To Top
The Settlement Administrator will decide whether the information provided on each Claim Form is complete and valid. The Settlement Administrator may require additional information. If you do not provide the additional information in a timely manner, then claim will be considered invalid and will not be paid.
Approved Claims are those submitted in a timely manner and found to be valid by and in an amount approved by the Settlement Administrator.
TMX’s payments and benefits under the Settlement are subject to the aggregate caps and pro rata reductions discussed in FAQ 6.
Back To Top
The Court will hold a hearing on August 12, 2025, at 10:00 a.m. ET to decide whether to approve the Settlement Agreement. This hearing date and time may be moved without notice to the class. If the Court approves the Settlement Agreement, there may still be appeals. It is always uncertain whether these appeals can be resolved, and resolving them can take time, perhaps more than a year. Please be patient.
Back To Top
If you make a claim under the Settlement, or if you do nothing, you will be releasing all of your claims relating to the Data Breach against TMX and any Released Parties when the Settlement becomes final. By releasing your claims, you are giving up the right to file, or to continue to pursue, separate legal claims against or seek further compensation from TMX or any Released Parties for any harm related to the Data Breach or the claims alleged in the lawsuits—whether or not you are currently aware of those claims.
Unless you exclude yourself from the Settlement (see FAQ 13), all of the decisions by the Court will bind you. That means you will be bound to the terms of the Settlement and accompanying Court orders and cannot bring a lawsuit or be part of another lawsuit against TMX or any Released Parties regarding the Data Breach.
Paragraphs 2.32, 2.33, and 2.45 of the Settlement Agreement defines the claims and parties that will be released by Settlement Class Members who do not exclude themselves from the Settlement. You can access the Settlement Agreement and read the specific details of the claims being released here.
If you have any questions, you can contact the Settlement Administrator (see FAQ 15).
Back To Top
Yes. The Court appointed MaryBeth V. Gibson of Gibson Consumer Law Group, LLC, Kelly K. Iverson of Lynch Carpenter, LLP, and Amy Keller of DiCello Levitt LLP as Class Counsel. You will not be charged by these lawyers for their work on this case. If you want to be represented by your own lawyer, you may hire one at your own expense.
Settlement Class Counsel can be reached at:
MaryBeth V. Gibson | Kelly Iverson | Amy Keller |
Back To Top
Class Counsel has undertaken this case on a contingency-fee basis, meaning they have paid for all of the expenses in the case and have not been paid any money in relation to their work on this case. Accordingly, Class Counsel will ask the Court to award them Attorneys’ Fees and Expenses. The Court will decide the amount of Attorneys’ Fees and Expenses to be paid. You will not have to separately pay any portion of these fees and expenses yourself. Class Counsel’s request for Attorneys’ Fees and Expenses (which must be approved by the Court) will be filed by June 23, 2025, and will be available to view on the Settlement website at www.TMXDataSecuritySettlement.com. Class Counsel agrees not to seek, will not accept, and shall not be awarded, more than $5,750,000.00 (five million seven hundred fifty thousand dollars) in combined Attorneys’ Fees and Expenses. Any payment of Attorneys’ Fees and Expenses will be made separately and in addition to any payments made to the Settlement Class and will not reduce the total amount of benefits available to the Settlement Class.
Back To Top
If you are a member of the Settlement Class, you may exclude yourself from the Settlement (also known as “opting out”). If you exclude yourself, you will lose any right to participate in the Settlement, including any right to receive the benefits outlined in this notice.
If you decide to opt out, you may keep any rights you have, if any, against TMX, and you may file your own lawsuit against TMX based upon the same legal claims that are asserted in this lawsuits, but you will need to find your own attorney at your own cost to represent you in that lawsuit or represent yourself. If you are considering this option, you may want to consult an attorney to determine your options.
IMPORTANT: You will be bound by the terms of the Settlement Agreement unless you submit a timely and signed written request to be excluded from the Settlement that includes the information identified below. To exclude yourself from the Settlement you must submit a “request for exclusion,” postmarked no later than July 7, 2025, to the following address:
TMX Data Settlement
c/o Settlement Administrator
P.O. Box 25043
Santa Ana, CA 92799
The statement must contain the following information:
Identify the case name and number of the Action (“Savannah Kolstedt et al. v. TMX Finance Corporate Services, Inc. et al., Case No. 4:23-cv-00076-RSB-CLR”);
Identify the name and address of the individual seeking exclusion from the Settlement;
Be personally signed by the individual seeking exclusion;
Include a statement clearly indicating the individual’s intent to be excluded from the Settlement; and
Request exclusion only for that one individual whose personal signature appears on the request.
Opt-out requests seeking exclusion on behalf of more than one individual shall be deemed invalid by the Settlement Administrator. Any purported mass or class opt-outs are not permitted.
If you do not comply with these procedures and the deadline for exclusions, you will lose any opportunity to exclude yourself from the Settlement, and your rights will be determined in this lawsuit by the Settlement Agreement if it is approved by the Court.
Back To Top
You can ask the Court to deny approval of the Settlement by submitting an objection. You can’t ask the Court to order a different settlement; the Court can only approve or reject the Settlement. If the Court denies approval of the Settlement, no settlement payments will be sent out, and the lawsuit will continue. If that is what you want to happen, you should object.
Any objection to the proposed Settlement must be in writing and mailed to the Settlement Administrator. If you submit a timely written objection, you may, but are not required to, appear at the Final Approval Hearing, either in person or through your own attorney. If you appear through your own attorney, you are responsible for hiring and paying that attorney. All written objections and supporting papers must include:
The case name and number of the Action (“Savannah Kolstedt et al. v. TMX Finance Corporate Services, Inc. et al., Case No. 4:23-cv-00076-RSB-CLR”);
The name, address, and telephone number of the objecting Settlement Class Member and, if represented by counsel, of his/her counsel;
A statement of whether the objection applies only to the objector, to a specific subset of the class, or to the entire class;
A statement of the number of times in which the objector (and, where applicable, objector’s counsel) has objected to a class action settlement within the three years preceding the date that the objector files the objection, along with the caption of each case in which the objector has made such objection;
Information identifying the objector as a Settlement Class Member, including proof that the objector is a member of the Settlement Class (e.g., copy of the objector’s settlement notice, copy of original notice of the Data Breach, or a statement explaining why the objector believes he or she is a Settlement Class Member);
A statement of the specific grounds for the objection; and
A statement of whether the objecting Settlement Class Member intends to appear at the Final Approval Hearing, and if so, whether personally or through counsel.
To be considered by the Court, your written objection must be sent via first-class, postage-prepaid United States mail and postmarked no later than July 7, 2025, to the following address:
TMX Data Settlement
c/o Settlement Administrator
P.O. Box 25043
Santa Ana, CA 92799
If you do not comply with these procedures and the deadline for objections, you may lose any opportunity to have your objection considered at the Final Approval Hearing or otherwise to contest the approval of the Settlement or to appeal from any orders or judgments entered by the Court in connection with the Settlement. You will still be eligible to receive Settlement benefits if the Settlement becomes final even if you object to the Settlement.
The Court has scheduled a Final Approval Hearing to listen to and consider any concerns or objections from Settlement Class Members regarding the fairness, adequacy, and reasonableness of the terms of the Settlement Agreement. That hearing is currently scheduled to take place on August 12, 2025, at 10:00 a.m. ET, before the Honorable R. Stan Baker, at the United States District Court for the Southern District of Georgia located at 8 Southern Oaks Court, Savannah, GA 31405. This hearing date and time may be moved without notice to the class. Please refer to this website for notice of any changes.
Back To Top
If you have questions about this website, the Notice or the Settlement, you may call the Settlement Administrator at 1-833-296-0855. You can also contact the Settlement Administrator at info@TMXDataSecuritySettlement.com or by mailing a letter to TMX Data Settlement, c/o Settlement Administrator, P.O. Box 25043 Santa Ana, CA 92799, for more information or to request that a copy of the Notice be sent to you in the mail. You may also seek advice and guidance from your own private lawyer at your own expense if you wish to do so.
This website and the Notice are only a summary of the lawsuit and the Settlement. Other related documents can be accessed through the Important Documents page of this website. The Court cannot respond to any questions regarding this notice, the lawsuit, or the proposed Settlement.
Please do not contact the Court, its Clerks, or TMX.
Back To Top