Published
October 31, 2026
People whom CBIZ notified that their personal or health information was exposed in the 2023 MOVEit data breach may qualify for up to $10,000 in documented losses or a $100 cash payment from a proposed $7.2 million CBIZ class action settlement. The settlement awaits preliminary approval, and claims are not open yet.
Current Status
Claims are not open. On October 30, 2026, plaintiffs asked Judge Allison D. Burroughs of the U.S. District Court for the District of Massachusetts to grant preliminary approval of a $7.2 million settlement with CBIZ, Inc., and CBIZ does not oppose the motion. There is no claim deadline, settlement website or final approval hearing date yet; those are set only if the court grants preliminary approval.Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Status
Pending Preliminary Approval
motion filed October 30, 2026 · unopposed by CBIZ
Claim Deadline
Not set yet
set by the court if it grants preliminary approval
Estimated Payout
Up to $10,000, or $100 cash
up to $2,500 ordinary losses · up to $10,000 extraordinary losses · $100 alternative cash, pro rata · two years of credit monitoring
Proof Required
Yes — Claim ID Expected
the notice postcard will carry a unique Claim ID · documents needed only for loss reimbursement
What Changed Recently?
CBIZ, a business services and benefits administration company, used MOVEit Transfer, file transfer software made by Progress Software Corporation. Between May 27 and May 31, 2023, the CL0P ransomware group exploited a flaw in the software and took data from many organizations that used it, including files on CBIZ’s MOVEit system. CBIZ later notified about 586,000 people that their information was involved.Lawsuits against CBIZ were folded into the nationwide MOVEit multidistrict litigation in Massachusetts. According to class counsel’s declaration, the parties signed a term sheet on February 20, 2026 and finished the settlement agreement on October 29, 2026; plaintiffs filed for preliminary approval the next day. The settlement resolves claims against CBIZ only, not against Progress, which remains a defendant in the wider litigation. Settling does not mean CBIZ admits wrongdoing, and the claims against it have not been proven.
Who Qualifies?
The proposed class is everyone in the United States, or living on a U.S. military installation abroad, who received a notice from CBIZ that their personally identifiable information or protected health information was included in the MOVEit data breach. The settlement papers estimate about 585,712 class members.CBIZ and its officers and affiliates, the judges handling the case and their families and staff, and anyone who opts out are excluded. This settlement covers only data exposed through CBIZ’s use of MOVEit; people notified by other MOVEit users are covered, if at all, by those companies’ own cases.
How Much Can You Get?
The $7.2 million fund is non-reversionary, so none of it goes back to CBIZ. Notice and administration costs, any court-approved attorneys’ fees and expenses, and service awards of up to $2,500 for each of the two class representatives come out first. The rest pays class members under the proposed Settlement Benefits Plan:- Ordinary losses, up to $2,500: unreimbursed out-of-pocket costs from the breach, such as bank fees and postage; credit reports, credit monitoring or identity theft insurance bought between May 31, 2023 and the end of the claim period; and up to four hours of lost time at $25 an hour, or $100, with an attestation.
- Extraordinary losses, up to $10,000: documented, unreimbursed monetary losses, professional fees or credit repair costs that were more likely than not caused by the breach and occurred between May 31, 2023 and the end of the claim period.
- Alternative cash payment, $100: instead of the two loss categories, a one-time payment with no documentation or time attestation. It can be reduced or increased pro rata depending on how many claims are filed.
- Credit monitoring: two years of three-bureau credit monitoring and identity theft protection, including up to $1 million in identity theft insurance, for any class member who files a claim for it, alongside any cash benefit.
What Proof or Notice ID Is Required?
According to the proposed notice plan, Kroll Settlement Administration will mail each class member a postcard notice with a unique Claim ID to use when filing, and send it by email where an address is available. Reimbursement for ordinary and extraordinary losses requires documentation, and lost-time claims require an attestation. The $100 alternative cash payment requires no documentation. Claimants who file online will be able to choose PayPal, Venmo or a check.What Is the Deadline?
No deadlines have been set yet. The proposed preliminary approval order filed with the motion ties every deadline to the date notice goes out, the “Notice Deadline”:• Notice: within 30 days after CBIZ gives Kroll the class list, which is due 10 days after the order is entered
• Opt-out and objection deadline: 60 days after the Notice Deadline
• Claim deadline: 90 days after the Notice Deadline
• Final approval hearing: at least 150 days after preliminary approval
Kroll would also send a reminder notice by email before the claim period ends. These are proposed terms the judge can change. OpenClassActions.com will add the actual calendar dates once the court sets them.
How Do You Take Action?
There is nothing to file yet. If the court grants preliminary approval, CBIZ will give the class list to Kroll within 10 days, and Kroll will then mail and email notices and launch a settlement website with the claim form. The case can be followed on the MOVEit litigation docket.What Happens Next?
The court will decide whether to grant preliminary approval. If it does, notices go out, the claim period opens, and the court schedules a final approval hearing. Payments and credit monitoring codes are sent only after final approval and any appeals are resolved.Sources and Verification
• Plaintiffs’ unopposed motion for preliminary approval of the CBIZ settlement (ECF No. 2175, October 30, 2026)• [Proposed] Order of Preliminary Approval (ECF No. 2175-1, October 30, 2026) — proposed notice, opt-out, objection, claim and hearing timetable
• Declaration of co-lead counsel Gary F. Lynch, with the settlement agreement and Settlement Benefits Plan (ECF No. 2177)
• Declaration of Kroll Settlement Administration on the notice plan (ECF No. 2178)
• In re: MOVEit Customer Data Security Breach Litigation, MDL No. 1:23-md-03083 (D. Mass.); related cases No. 23-cv-12725 and No. 23-cv-13030
Questions
Who is covered by the CBIZ MOVEit settlement?
People in the United States, or living on U.S. military installations abroad, who received a notice from CBIZ that their personal or health information was included in the 2023 MOVEit data breach. The settlement papers estimate about 585,712 class members.
How much can I get from the CBIZ MOVEit settlement?
Under the proposed terms, up to $2,500 for documented ordinary losses, including up to $100 for lost time, and up to $10,000 for documented extraordinary losses. Instead of those, a class member can choose a one-time cash payment of $100, which can go up or down pro rata. Two years of credit monitoring is available to anyone who files a claim.
Can I file a CBIZ MOVEit claim now?
No. Plaintiffs asked the court for preliminary approval on October 30, 2026. Claims open only after the court grants it and the administrator, Kroll, sends notices and launches the settlement website.
Is this the same as the other CBIZ data breach settlement?
No. This settlement covers only CBIZ’s part of the 2023 MOVEit Transfer breach, resolved in the MOVEit multidistrict litigation in Massachusetts. A separate CBIZ data breach settlement in South Carolina covers a different incident.
For more class actions keep scrolling below.
Settlement Amount
$7,200,000 (proposed)
Case Title
In re: MOVEit Customer Data Security Breach Litigation (CBIZ, Inc. settlement)
Case Number
MDL No. 1:23-md-03083
Court
U.S. District Court, District of Massachusetts
Administrator
Kroll Settlement Administration (proposed)
