The roughly 5,382 people whose personal information was compromised in the November 2023 cyberattack on duty-free retailer International Shoppes may qualify to claim a $50 cash payment, or instead up to $4,000 in documented out-of-pocket losses, plus two years of credit monitoring either way. Claims close November 11, 2026, and the LoginID and PIN printed on the mailed notice are required to file online.
Current Status
Claims are open. A Claim Form must be submitted online or by email by November 11, 2026, or mailed with a postmark no later than that date. Neither the notice nor the settlement website states a timezone for the deadline, so none is given here.The court has not approved the settlement. The final approval hearing is scheduled for November 16, 2026 at 9:30 a.m. Eastern Time in the third-floor courtroom of the Supreme Court of the State of New York, Nassau County, in Mineola, and the notice warns the date and time may change without further notice. No payments have been made and no payment date has been announced. The notice says settlement payments are distributed only if the court grants final approval and after any appeals are resolved.
Check one thing before you start: the online claim form opens on a login screen asking for a LoginID and a PIN, both printed on the notice mailed to class members. There is no way past that screen without them, and the settlement website directs anyone who cannot find them to ask the administrator for a replacement.
What Is This Settlement About?
International Shoppes, LLC operates duty-free and travel retail stores in United States airports. It and Diplomatic Duty Free Shops of New York, Inc. are the defendants in this settlement, and the notice refers to the two together as International Shoppes.The settlement agreement defines the Data Incident as the data security event affecting the defendants that occurred on or around November 16, 2023. The court-authorized notice describes it as a cyberattack on International Shoppes' computer systems in which certain files containing personal information were accessed, and says those files may have contained names, addresses, birth dates, Social Security numbers, driver's license and passport information, financial account numbers and health information. The complaint asserted claims for negligence, breach of implied contract, unjust enrichment, breach of fiduciary duty, violation of New York's deceptive trade practices statute and declaratory judgment.
International Shoppes denies that it did anything wrong, and the court has not decided who is right. The agreement states that the defendants deny the allegations and all liability, deny that the class representatives or the class suffered any damages, and deny that the case satisfies the requirements to be tried as a class action. The parties agreed to settle to avoid the cost, risk, disruption and uncertainty of continuing the litigation, and the agreement is expressly not an admission of fault or liability by anyone.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Who Qualifies?
The court defined the settlement class as all individuals residing in the United States whose personal information was compromised in the Data Incident discovered by the defendants in December 2023, including all those individuals who received notice of the Data Incident. The settlement agreement adds a number the notice does not: the defendants represent that the class consists of approximately 5,382 individuals.That is a small class by data-breach standards, and it is a closed one. Membership runs off a list the defendants generate from their own records and hand to the administrator, so if International Shoppes mailed you a notice you are in it, and the notice says the company's records indicate as much. Many class members will also have received an earlier notification directly from International Shoppes about the incident itself.
Three groups are excluded:
• The judiciary. The judge presiding over the case, along with the judge's family and staff.
• The companies. International Shoppes and its officers, directors and related companies — the agreement extends this to subsidiaries, parent companies, successors, predecessors and any entity in which the defendants or their parents have a controlling interest.
• Anyone who opts out. Class members who submit a valid request for exclusion before the October 12, 2026 deadline leave the class and receive nothing from the settlement.
Class membership is not limited to New York. The class is defined by residence in the United States, not by the state the case was filed in.
How Much Can You Get?
The settlement offers a credit monitoring benefit that everyone in the class can take, plus a choice between two cash options that cannot be combined with each other.• Credit monitoring, available to everyone. Two years of CyEx Financial Shield Complete. The settlement agreement describes it as one-bureau credit monitoring with dark web monitoring, real-time inquiry alerts and $1 million in identity theft insurance, and the notice adds monitoring for fraud or identity theft, unauthorized financial transactions and high-risk financial transactions, with access to a fraud resolution agent. The agreement is explicit that enrollment is open to all participating class members regardless of whether or which cash benefit they elect, so it stacks with either cash option or can be claimed on its own.
• Alternative Cash Payment — $50. A single payment with no supporting documentation required. To receive it, a class member checks the appropriate box on the Claim Form. The notice describes the figure as expected to be $50.00 but says it may be smaller depending on the total claims filed. Electing it forecloses any other monetary claim under the settlement.
• Out-of-pocket losses — up to $4,000. Reimbursement of actual, documented out-of-pocket losses that a class member incurred as a result of the Data Incident, capped at $4,000 per claimant. The losses must have occurred between November 16, 2023 and November 11, 2026.
The notice lists what the out-of-pocket option covers: losses because of identity theft or fraud; fees for credit reports, credit monitoring, or freezing and unfreezing credit; the cost to replace identification documents; and postage to contact banks by mail. The settlement agreement's fuller definition also reaches professional fees for attorneys, accountants or credit repair services, and incidental expenses such as notary, fax, copying, mileage and telephone charges. Documented monetary losses from fraud, identity theft or misuse count only if they occurred after November 16, 2023, are more likely than not caused by the Data Incident, and the class member made reasonable efforts to mitigate them or obtain reimbursement. Expenses already reimbursed by a third party cannot be claimed.
One number governs the whole thing: the agreement sets a $500,000 aggregate cap, and if the total value of claimed benefits exceeds it, every payment is reduced pro rata so the total comes back under the cap. Our explainer covers how pro rata settlement payments are calculated. At the class size the defendants represent, $50 for all 5,382 members would come to $269,100. The cap also has to absorb approved out-of-pocket claims of up to $4,000 apiece and, under Paragraph 52 of the agreement, the cost of notice and administration — so a reduction is possible and the notice says so, even though the flat-cash arithmetic on its own leaves room.
Attorneys' fees do not come out of any of this. Class counsel will ask the court to approve up to $165,000 in fees and litigation costs, which the agreement says International Shoppes pays separate and apart from the settlement benefits to the class, and service awards of up to $4,500 for each of the two class representatives, also paid by International Shoppes. The court may award less than what is requested.
What Proof or Notice ID Is Required?
Proof is required here in two separate senses, and only one of them applies to every claimant.Everyone filing online needs a LoginID and PIN. The claim portal on the official settlement website opens on a login step asking for both, and the website says they are printed on the notice that was mailed to class members. Because filing online is gated on administrator-issued credentials, this settlement is Proof Required even for the $50 option, where no receipts are involved. Anyone who cannot locate the credentials is directed to contact the administrator and request them by supplying a full name and mailing address; the administrator can also send a paper Claim Form.
Out-of-pocket claimants additionally need documentation. Those claims must be supported by proof such as bank statements or receipts showing what was spent or lost. The notice says a class member may also submit self-made notes or papers to explain or support other proof, but that those notes alone are not enough to make a valid claim. The settlement agreement puts it in the same terms: documentation that is not self-prepared by the claimant, with self-prepared documents insufficient by themselves though capable of adding clarity or support. Every out-of-pocket claim also carries an attestation under penalty of perjury that the class member reasonably believes the loss was incurred as a result of the Data Incident and was not previously reimbursed.
The administrator reviews claims and may contact a class member to seek clarification before deciding. Where a claim is found deficient in whole or in part, the agreement gives the class member 21 days to cure it, and a further 21 days to appeal in writing if the administrator concludes the deficiency was not cured.
What Is the Deadline?
Three dates matter, and the first two are more than a month apart:• October 12, 2026 — deadline to opt out, and the deadline to object. A request for exclusion must be submitted, postmarked or emailed by this date and must carry the case name and index number, the class member's contact details, a personal signature, and the words "Request for Exclusion" or a clear equivalent. An objection must be filed with the Clerk of Court by the same date, with copies sent to the administrator, class counsel and counsel for the defendants, and it has nine required elements. A class member may exclude only themselves, not anyone else. Our guide covers what opting out of a class action costs and preserves.
• November 11, 2026 — Claim Form deadline. Online and email submissions must be in by this date; a mailed form must be postmarked by it.
• November 16, 2026 at 9:30 a.m. Eastern Time — final approval hearing, in the third-floor courtroom of the Supreme Court of the State of New York, Nassau County, in Mineola.
The hearing is the only one of the three the notice attaches a timezone to. Treat November 11 as a date rather than an hour and file well before it. The gap between the two deadlines has a practical consequence: the decision to leave the settlement and keep your own right to sue over the breach closes a month before the decision to file for money does.
How Do You File a Claim?
File through the official settlement website, IShoppes Data Settlement.com. Have the mailed notice in front of you before you start, since the LoginID and PIN it carries are what get you past the login screen.The site also offers a downloadable Claim Form that can be completed, signed and returned to the administrator by email or U.S. mail together with any supporting documentation. That route runs to the same November 11, 2026 deadline, with mailed forms judged by postmark. A class member who prefers paper, or who wants a form sent to them, can request one from the administrator.
Whichever route you take, decide which cash option you want before you begin, because they are alternatives rather than a menu. If you have documented losses from the breach worth more than $50, the out-of-pocket path is the one that pays them; if you do not, the $50 needs nothing but the checkbox. The credit monitoring is a separate election and does not cost you either one.
What Happens Next?
The next milestone is the November 16, 2026 final approval hearing, where the court will decide whether to approve the settlement, rule on the requests for attorneys' fees and service awards, and consider any timely objections. Class members do not have to attend; a class member or their attorney may ask permission to speak, at their own cost. The notice says the date and time may change without further notice.A hearing being held is not the same as approval being granted. The notice says that if the court approves the settlement there may still be appeals, that nobody knows whether appeals will be filed or how long they would take to resolve, and that settlement payments are distributed only after final approval and after any appeals are resolved. No payment date had been announced as of September 1, 2026.
Two mechanics worth knowing for whenever payment does arrive. Settlement checks carry a legend saying they expire if not negotiated within 90 days of their issue date, and a check that goes void forfeits the right to payment. A check returned as undeliverable is reissued within 30 days once the administrator locates a valid address, and a replacement check stays negotiable for 60 days. On a settlement whose payments may be a year or more away, keeping a current address with the administrator is the class member's own responsibility.
Sources and Verification
• Official settlement website — IShoppes Data Settlement.com (claim portal, FAQs, deadlines and settlement documents)• Notice of Proposed Class Action Settlement (PDF) — class definition, benefits, deadlines and the final approval hearing
• Settlement Agreement and Release, executed January 2026 — the aggregate cap, the class size, the credit monitoring specification, the claims review and payment mechanics, and the fee and service award terms
• Official claim portal — the LoginID and PIN login step and the downloadable Claim Form
• Peter Lazar and Sheba Khan v. International Shoppes, LLC and Diplomatic Duty Free Shops of New York, Inc., Index No. 623891/2025, Supreme Court of the State of New York, Nassau County
Questions
The notice says November 2023 but the class definition says December 2023 — which is it?
Both dates describe the same incident. The settlement agreement defines the Data Incident as the data security event affecting the defendants that occurred on or around November 16, 2023. The settlement class is then defined by when the defendants found it: all individuals residing in the United States whose personal information was compromised in the Data Incident discovered by the defendants in December 2023. November 2023 is when the cyberattack happened; December 2023 is when International Shoppes discovered it. There is only one incident and one class.
Can I take the credit monitoring and a cash payment, or do I have to pick one?
The credit monitoring stacks. The settlement agreement says enrollment in Credit Monitoring Services is available to all participating class members regardless of whether or which cash benefit they elect, so two years of CyEx Financial Shield Complete can be claimed alongside either cash option, or on its own. The two cash options are the ones that are mutually exclusive: a class member who elects the Alternative Cash Payment may not also submit a claim for out-of-pocket losses.
What if I never received the notice, or cannot find my LoginID and PIN?
The online claim form opens on a login screen and will not advance without both credentials, which are printed on the notice mailed to class members. The settlement website tells class members who cannot locate them to contact the settlement administrator and request them by supplying a full name and mailing address. The administrator can also send a paper Claim Form on request. Use the Contact page on the official settlement website to reach the administrator.
Will the Alternative Cash Payment actually be $50?
It is an estimate, not a guarantee. The notice says the payment is expected to be $50.00 but may be smaller depending on the total claims filed. The settlement carries a $500,000 aggregate cap, and if the total value of claimed benefits exceeds that figure, every payment is reduced pro rata so the total comes back under the cap. The defendants represent that the class is approximately 5,382 individuals, so $50 for every single class member would come to $269,100 — but the cap also has to absorb approved out-of-pocket claims of up to $4,000 each and, under Paragraph 52 of the settlement agreement, the cost of notice and administration.
Do the attorneys' fees come out of my payment?
No. This settlement has no common fund that fees are deducted from. The settlement agreement says class counsel will ask the court to approve up to $165,000 in attorneys' fees and litigation costs, paid by International Shoppes separate and apart from the settlement benefits to the class, and service awards of up to $4,500 for each of the two class representatives, also paid by International Shoppes. The court decides whether to approve those amounts and may award less. Either way the money does not come out of a claimant's payment.
Why is this case in a New York state court when it started in federal court?
The litigation moved after the parties settled it. The recitals to the settlement agreement say the case was filed in the U.S. District Court for the Eastern District of New York on June 11, 2024, that the court granted the defendants' motion to dismiss in part on May 22, 2025 while letting the negligence, breach of implied contract and declaratory judgment claims proceed, and that the parties reached a settlement in principle at a mediation on October 22, 2025. The plaintiffs then dismissed the federal action without prejudice and refiled on November 5, 2025 in the Supreme Court of the State of New York, Nassau County, which is the court now being asked to approve the settlement.
