U.S. residents whose personal information was potentially accessed in the cyberattack on Educational Computer Systems, Inc. (ECSI) between October 29, 2023 and February 12, 2024 may qualify to claim an estimated $100, or instead up to $5,000 in documented losses, from the $6.5 million ECSI data breach class action settlement. Claims close December 21, 2026; the final approval hearing is set for January 11, 2027.
Current Status
Claims are open. Claim forms must be submitted online or postmarked by December 21, 2026. The court authorized notice to the class, and a telephonic final approval hearing is scheduled for January 11, 2027, at 9:30 a.m. Eastern. The settlement has not received final approval, and no payment date has been announced as of October 2, 2026. Class members who want money have to file a claim.Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Changed Recently?
Educational Computer Systems, Inc. agreed to a $6.5 million settlement of Hood, et al. v. Educational Computer Systems, Inc., a consolidated class action in the U.S. District Court for the Western District of Pennsylvania. The court authorized notice to class members, and the claim process is now open on the official settlement website.ECSI, based in Coraopolis, Pennsylvania, provides student loan servicing, tuition payment plans and tax document services for colleges and universities. According to the notice, cybercriminals attacked ECSI’s website between October 29, 2023 and February 12, 2024, potentially exposing personal information. The consolidated complaint alleges that the attackers used a guest tax-form lookup on the website to pull students’ and borrowers’ Form 1098-E and 1098-T tax documents, which include names, addresses and Social Security or taxpayer identification numbers, and that ECSI did not notice for about four months. The lawsuit claims ECSI’s data security was inadequate. ECSI denies the allegations and any liability, and the court has not ruled for either side.
Who Qualifies?
The settlement class includes all persons residing in the United States whose personal information was potentially accessed in the ECSI security incident between October 29, 2023 and February 12, 2024. People who received a settlement notice are on the class list.The presiding judge and the judge’s staff and immediate family, anyone convicted of or pleading no contest to involvement in the attack, and anyone who opts out are excluded.
How Much Can You Get?
Each class member chooses one of two benefits.- Out-of-pocket losses: reimbursement of up to $5,000 for documented, unreimbursed losses more likely than not caused by the incident between October 29, 2023 and December 21, 2026. Eligible losses include fraud losses, bank fees, per-minute phone and usage-based data charges, postage, local travel gas, and credit reports, credit monitoring or identity theft protection bought during that period.
- Alternative cash payment: a pro rata payment estimated at about $100, with no documentation required.
The two cannot be combined. The $6.5 million fund also pays attorneys’ fees and costs (class counsel may seek up to one-third, or $2,166,666.66), service awards of $2,500 for each class representative, and administration costs. The cash payment is calculated at the end of the process and rises or falls with the number of approved claims, so the $100 figure is an estimate rather than a fixed amount. OCA’s explainer on pro rata distribution covers how that adjustment works.
What Proof or Notice ID Is Required?
The online claim form opens with a login screen that asks for the Notice ID and Confirmation Code printed on the class member’s notice. Without those codes, the online form cannot be completed.The printable claim form posted on the official settlement website does not ask for a Notice ID. It asks only for name, contact information, the benefit chosen, a payment method and a signature. A class member who no longer has the notice can complete that form and mail it to the settlement administrator, postmarked by the deadline.
The $100 cash option needs no documentation. A claim for out-of-pocket losses must include records showing the amount lost and why it was more likely than not caused by the incident, such as card or bank statements, invoices, receipts, emails or phone records. Self-prepared documents like handwritten receipts are not enough on their own.
What Is the Deadline?
Claim forms must be submitted online or postmarked by December 21, 2026. The official sources give a date only, with no time of day for the claim deadline.Requests to opt out must be mailed by first-class mail, postmarked by November 20, 2026, to the exclusion address listed in the notice on the official settlement website, and must include the case name and number, full name, postal and email address, a signature and a clear statement asking to be excluded. Objections are due the same day, either filed with the court or mailed to the court, class counsel and ECSI’s counsel. Anyone who opts out gets no payment and cannot object.
How Do You Take Action?
File online through the official ECSI settlement claim form using the Notice ID and Confirmation Code, or download the paper claim form from the official settlement website and mail it to the administrator. Choose either the cash payment or documented losses, attach documents if claiming losses, and sign the form.The claim form offers payment by PayPal, Venmo, Zelle or a mailed check. Other open data breach settlements are listed on the data breach settlements hub.
What Happens Next?
Class counsel will file the application for attorneys’ fees, expenses and service awards by November 5, 2026, and the motion for final approval by December 21, 2026; both will be posted on the settlement website. The court will hold the final approval hearing by telephone on January 11, 2027, at 9:30 a.m. Eastern, and may reschedule it without further notice.Payments will be made only after final approval and after any appeals are resolved. No payment date had been announced as of October 2, 2026.
Sources and Verification
- ECSI Security Incident Settlement — official settlement website
- Court-authorized long-form notice
- Printable claim form
- Settlement Agreement and Release
- Consolidated Amended Complaint (September 13, 2024), Hood, et al. v. Educational Computer Systems, Inc., No. 2:24-cv-00666-CCW (W.D. Pa.)
Questions
Can I get both the $100 payment and reimbursement for my losses?
No. Each class member chooses one: reimbursement of documented out-of-pocket losses up to $5,000, or the alternative cash payment estimated at about $100. The claim form will not accept both.
What if I lost my notice and do not have a Notice ID?
The online claim form opens with a login that asks for the Notice ID and Confirmation Code from the notice. The printable claim form posted on the official settlement website does not ask for either one, so a class member without a notice can print it, complete it and mail it to the settlement administrator, postmarked by December 21, 2026.
Why might the cash payment be more or less than $100?
The $100 figure is an estimate. Attorneys’ fees, service awards, administration costs and documented-loss reimbursements are paid from the $6.5 million fund first, and what remains is split among everyone who chose the cash payment. More approved claims means a smaller share, and fewer means a larger one.
What kinds of documents support a claim for losses?
Credit card or bank statements, invoices, receipts, emails or telephone records, including photos of them. The documents must show the amount lost and why the loss was more likely than not caused by the security incident. Handwritten receipts or other self-prepared documents are not enough on their own.
How is the payment sent?
The claim form offers PayPal, Venmo, Zelle or a physical check mailed to the address on the claim. Payments are made only after the court grants final approval and any appeals are resolved.
