This settlement resolves a class action over the June 2025 data security incident at Dairy Farmers of America, the farmer-owned milk cooperative headquartered in Kansas City, Kansas. If a notice reached you, there are three benefits on the table — two years of credit monitoring, an expected $55 cash payment, and reimbursement of up to $4,500 in documented losses — but unlike many recent breach settlements, none of them arrive on their own. Every one of them requires a Claim Form by October 14, 2026.
Current Status
Claims are open. The deadline to submit a Claim Form is October 14, 2026, whether you file online, send it by email, or mail it — a mailed form must carry a postmark no later than that date. The Notice does not specify a cutoff time, so only the date is published here. The deadline to exclude yourself or to object is a month earlier, on September 14, 2026. The District Court of Wyandotte County, Kansas authorized the notice program, and the Final Approval Hearing is set for October 26, 2026 at 10:00 a.m. Central Time. No final approval order has been entered and no payment date has been announced.What Changed Recently?
The claim window is open and the notice program has run. The case is Jason Buhl v. Dairy Farmers of America, Inc., Case No. WY-2026-CV-000143, in the District Court of Wyandotte County, Kansas, with Simpluris administering. Notices carrying each class member's LoginID and PIN have gone out to the class list, and the online claim portal is live.The incident behind the case dates to June 2025. The Notice describes it as a data security incident at DFA in June 2025 in which certain files containing private information may have been accessed by an unauthorized third party, and says those files may have held personal information — information identifying an individual, or information that in combination with other data could be used to identify, locate, or contact one. The settlement documents do not go further than that.
Public reporting on DFA's breach notices fills in the specifics the settlement papers leave out. According to that reporting, the unauthorized access began on June 11, 2025 and was discovered two days later, the intruder got in through what DFA described as a sophisticated social engineering campaign, and the breach notice DFA filed with the Maine Attorney General's office reported 4,546 people affected. The data types listed there were names, Social Security numbers, driver's license or state ID numbers, dates of birth, bank account numbers, and Medicare or Medicaid numbers. DFA began mailing notification letters on October 14, 2025. The Play ransomware group claimed credit for the attack on its leak site — that is the group's own claim, not something DFA or the Court has confirmed.
DFA denies that it did anything wrong, and the Notice states plainly that the Court has not decided who is right. Both sides agreed to settle to avoid the costs, risks, disruptions and uncertainties of continuing the litigation.
Who Qualifies?
The Court defined the Class as all individuals residing in the United States whose Personal Information was compromised in the Data Incident, including all those individuals who received notice of the Data Incident. That is the whole test — no state residency requirement beyond living in the United States, no requirement that you still work for DFA or still be a member of the cooperative. The Notice adds that DFA's records indicate class members are entitled to benefits, and that some people may have received an earlier notice directly from DFA, which lines up with the October 2025 mailing.Excluded from the Class are the judge assigned to the case along with that judge's family and staff; DFA and its officers, directors and related companies; and anyone who validly excludes themselves from the settlement.
A practical note on who can actually file: the online portal is gated on a LoginID and PIN printed on the mailed notice. So while the class definition is written broadly enough to reach people beyond the notified list, in practice the people who can complete a claim are the people DFA identified and wrote to.
How Much Can You Get?
There are three benefits, and the structure here is worth reading carefully because it is the opposite of what a lot of recent breach settlements do: nothing is automatic.• Credit monitoring. Two years of CyEx Financial Shield Total, which the Notice describes as carrying $1 million of financial fraud insurance and monitoring for fraud or identity theft, unauthorized financial transactions, and personal information associated with high-risk transactions, with access to a fraud resolution agent if something turns up. Every class member is eligible — but you have to claim it.
• Out-of-Pocket Losses. Up to $4,500.00 for documented, unreimbursed out-of-pocket losses caused by the incident. The listed categories are losses from identity theft or fraud; fees for credit reports, credit monitoring, or freezing and unfreezing credit; the cost of replacing IDs; and postage to contact banks by mail. The losses must have occurred between June 11, 2025 and October 14, 2026 and be fairly traceable to the Data Incident, and nothing is paid for an expense a third party already reimbursed.
• Alternative Cash Payment. A one-time cash payment the Notice expects to be $55.00, with no proof or explanation required. It may come in smaller depending on how many claims are filed.
The two cash options are alternatives — you take one or the other, not both — but either one can be combined with the credit monitoring, since the Notice says all settlement class members may claim the monitoring and one of the two cash payment options.
Both cash options draw on one shared ceiling: an aggregate cap of $475,000.00. If the total value of cash payments claimed exceeds that figure, every payment is reduced pro rata until they add up to $475,000.00. On most breach settlements that cap is the main risk to the estimate. Here the published numbers suggest it is less of one. The Maine filing put the affected population at 4,546 people; at $55.00 apiece, claims from every single one of them would total roughly $250,030 — a little over half the cap. That is arithmetic from published figures rather than a forecast, and it comes with real caveats: the settlement documents never state a class size, the Notice itself says the $55.00 may shrink, and approved documented-loss claims of up to $4,500.00 each pull from the same pool.
Nothing else comes out of that money. Class Counsel will ask the Court to approve $158,333.33 as attorneys' fees and reimbursement of litigation costs, and a service award of $2,500.00 for the class representative, and the Notice states that DFA pays both separately and apart from the other settlement benefits. The Court decides those amounts and may award less.
What Proof or Notice ID Is Required?
To file online you need the LoginID and PIN printed on the notice mailed to you, which makes this settlement Proof Required: Yes even for the $55.00 payment that needs no receipts. The claim portal on the official settlement website asks for both before you can start a form. If you cannot find them, the site's contact page is the route to ask the Settlement Administrator for a replacement — the instructions ask you to give your full name and mailing address when requesting them.The $4,500 tier adds real evidentiary requirements on top. You must send proof such as bank statements or receipts showing what you spent or lost. Self-prepared notes or papers may be submitted to explain or support other proof, but the Notice is explicit that they are not enough on their own to make a valid claim, and the proof or notes must show that the expenses were because of the Data Incident. The claim is submitted under penalty of perjury.
The credit monitoring needs no documentation — but it does need a Claim Form, and that form runs through the same LoginID and PIN gate.
What Is the Deadline?
October 14, 2026 is the deadline to submit a Claim Form. The official settlement website states that the deadline to submit online or by email is October 14, 2026, and that a mailed Claim Form must carry a postmark no later than the same date. The Notice does not specify a cutoff time on that day, so no time is published here.Important: the deadline to exclude yourself or to object is September 14, 2026 — a month before the claim deadline. Missing it does not cost you your claim, but it does end your ability to leave the settlement or to be heard about it.
Excluding yourself has its own mechanics. A Request for Exclusion must be personally signed and must identify the litigation by name and case number, give your full name, mailing address, telephone number and email address, and include the words "Request for Exclusion" or a clear equivalent. You may only exclude yourself, not anyone else, and it must be submitted, postmarked, or emailed by September 14. Objecting is more demanding: an objection has to be filed with the Clerk of Court by the same date and copied to the Settlement Administrator, Class Counsel and counsel for the defendant, and it must identify the litigation, give your contact details, set out a clear description of every reason you object along with any legal support, state whether the objection applies only to you or to other class members, name any lawyer you have retained including their bar number, say whether you or that lawyer want to speak at the Final Approval Hearing, list any other cases in which you or your lawyer have objected, and carry your signature. The Notice says an objection must meet each of those requirements to be valid. You cannot object if you have excluded yourself.
How Do You Take Action?
File through the official settlement website at DFA Data Settlement.com, logging in with the LoginID and PIN from your notice. The same site hosts the Notice, a downloadable Claim Form, the Important Documents and Important Dates pages, and the full Settlement Agreement, whose terms control over any summary — including this one.On the form, decide two things. First, whether you want the credit monitoring; claim it if you do, because it will not show up otherwise. Second, which cash option fits: the flat payment if you have nothing to document, or the documented tier if you have receipts or bank statements for breach-related costs. If you prefer paper, the Claim Form can be downloaded from the site and returned by email or U.S. mail, with any supporting documentation attached.
If you do nothing at all, you receive nothing — not the cash, and not the monitoring — and you remain bound by the release, which gives up your ability to be part of any other lawsuit against DFA over the issues this settlement covers. Section IX of the Settlement Agreement sets out exactly what is released.
What Happens Next?
The Final Approval Hearing is scheduled for October 26, 2026 at 10:00 a.m. Central Time at the Wyandotte County Courthouse in Kansas City, Kansas. At that hearing the Court decides whether to approve the settlement, rules on Class Counsel's fee request and the service award, and considers any objections. Attendance is optional — Class Counsel answers the Court's questions — and the Notice cautions that the date, time and location may change without further notice, so the official settlement website is the place to confirm it.A hearing being held is not the same as approval being granted. The Notice states that if the Court approves the settlement there may be appeals, that it is not known whether any will be filed or how long they would take to resolve, and that settlement payments are distributed only after final approval and after any appeals are resolved. No payment date has been announced.
If the data-breach claims process itself is new to you, the data breach class action explainer walks through how these cases work, and the open data breach settlements tracker lists every other one currently taking claims.
Sources and Verification
• Official settlement website — DFA Data Settlement.com• Notice of Proposed Class Action Settlement, Jason Buhl v. Dairy Farmers of America, Inc.
• Frequently Asked Questions and Important Dates pages maintained by the Settlement Administrator, Simpluris
• Settlement Agreement and Claim Form posted on the official settlement website
• Jason Buhl v. Dairy Farmers of America, Inc., Case No. WY-2026-CV-000143, District Court of Wyandotte County, Kansas
• Breach notice filed by Dairy Farmers of America with the Maine Attorney General's office, as reported in security press coverage of the incident (affected count, data types, and incident timeline)
Questions
Do I have to file a claim to get the credit monitoring?
Yes, and this is the detail most likely to cost people something. Several recent data breach settlements hand out the monitoring automatically and gate only the cash behind a Claim Form. This one does not. The Notice's summary of rights states that the only way to receive benefits or payments from this Settlement is by submitting a valid and timely Claim Form, and the answer to what happens if you do nothing is that you will not receive a benefit at all. The two years of CyEx Financial Shield Total is a claimed benefit here, not an automatic one.
How likely is the $55 payment to be cut by the pro rata reduction?
Less likely than on most data breach settlements, based on the published figures. The aggregate cash cap is $475,000.00, and the breach notice Dairy Farmers of America filed with the Maine Attorney General's office reported 4,546 people affected. At $55.00 apiece, 4,546 claims would total about $250,030 — roughly half the cap. That is arithmetic from the published numbers, not a prediction: the settlement documents do not state a class size, the Notice says the payment may be smaller depending on the total claims filed, and documented out-of-pocket claims of up to $4,500.00 each draw on the same $475,000.00 pool.
Dairy Farmers of America already offered me credit monitoring in 2025. Is this the same thing?
No. Security reporting on the original breach notices said DFA offered affected individuals complimentary identity protection when it began mailing letters in October 2025. The monitoring described in this settlement is a separate benefit under the settlement itself — two years of CyEx Financial Shield Total, which the Notice describes as carrying $1 million of financial fraud insurance and monitoring for fraud or identity theft, unauthorized financial transactions, and personal information tied to high-risk transactions, with access to a fraud resolution agent. You have to claim it on the Claim Form to receive it.
Why does the out-of-pocket loss window start on June 11, 2025?
The Notice sets the eligible window for documented losses at June 11, 2025 through October 14, 2026, and requires that the losses be fairly traceable to the Data Incident. Security reporting on DFA's breach notices dates the start of the unauthorized access to June 11, 2025, so the window opens on the first day of the incident and closes on the claim deadline. Expenses a third party has already reimbursed cannot be claimed.
Do the attorneys' fees reduce what class members receive?
No. Class Counsel will ask the Court to approve $158,333.33 as attorneys' fees and reimbursement of litigation costs, plus a service award of $2,500.00 for the class representative, and the Notice states that DFA pays both separately and apart from the other Settlement benefits. Neither figure comes out of the $475,000.00 available for cash payments. Worth noting for context: the fee request happens to equal exactly one-third of that $475,000.00 cash cap. The Court decides both amounts at the Final Approval Hearing and may award less.
The case is in a Kansas state court. Does that limit who can claim?
No. The Court defined the Class as all individuals residing in the United States whose Personal Information was compromised in the Data Incident, including everyone who received notice of it. There is no Kansas residency requirement and no requirement that you be a current DFA employee or member. The venue reflects where the cooperative sits: Dairy Farmers of America is headquartered in Kansas City, Kansas, which is in Wyandotte County, and the case is pending in the District Court of Wyandotte County.
