This settlement resolves claims over a February 2025 cyberattack on KYB Americas Corporation, the vehicle suspension component manufacturer in Franklin, Indiana, in which an intruder had six days inside the network and took data. If you were notified, you can take a flat $75 or a period of credit monitoring with no documentation at all, or instead claim up to $5,300 in documented losses — but the claim window closes August 26, 2026.
Current Status
Claims are closed. The deadline was August 26, 2026. The settlement resolves Johnson et al. v. KYB Americas Corporation, Case No. 49D01-2508-CE-038312, in the Indiana Commercial Court within the Marion County Superior Court. No final approval order and no payment date had been announced as of the date this page was last updated. Class members who did not opt out remain bound by the release whether or not they filed.What Changed Recently?
The claim window is at its end. KYB Americas Corporation agreed to settle the class action over the February 2025 data security incident, notice went out to the class, and the claim portal has been live on the official settlement website through a claim period that closes August 26, 2026.KYB denies the allegations, and no court has found that it did anything wrong. The parties agreed to settle to avoid the costs, risks, disruptions and uncertainties of continuing the litigation.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What the Case Is About
KYB Americas Corporation is the North American arm of a vehicle suspension component manufacturer, based in Franklin, Indiana, where it produces shock absorbers and struts.KYB has said it detected suspicious activity on its network on February 18, 2025. A forensic investigation determined that an unauthorized third party had access to its systems for six days, from February 11 to February 17, 2025, and exfiltrated data. The company began notifying affected individuals by mail on April 22, 2025, providing those individuals with a list of the specific types of information involved and offering complimentary credit monitoring.
The ransomware group Cactus claimed responsibility for the attack. That is the group's own claim rather than a confirmed finding — attackers routinely overstate what they took, and a claim posted on a leak site is not evidence of its contents.
The lawsuit alleged that KYB failed to adequately protect the information in its systems. Those are allegations. The Court has made no finding of wrongdoing and the company denies it.
Who Qualifies?
You are a class member if you reside in the United States and your Personal Information was compromised in the data security incident KYB discovered in February 2025, including individuals who received notice of the breach.Because KYB is a manufacturer rather than a consumer retailer, most people holding a notice are current or former employees and others whose records the company held, rather than people who bought a product. The notice mailed from April 22, 2025 is the practical marker of membership.
How Much Can You Get?
The settlement offers two routes, and the published materials present them as alternatives rather than as benefits that stack:- A flat cash payment of $75, or a period of credit monitoring. Neither requires any documentation.
- Instead of that, reimbursement of documented ordinary losses up to $300 and documented extraordinary losses up to $5,000 — up to $5,300 in total — for class members who suffered actual financial harm traceable to the incident.
For most class members the flat $75 is the realistic outcome, because most people cannot document a loss that traces specifically to one breach. The documented route is worth the effort only where the paper trail genuinely exists: a fraudulent charge you absorbed, a monitoring service you paid for yourself after the notice arrived, the cost of replacing identification. Anything a bank, insurer or employer already reimbursed cannot be claimed a second time.
The Claim Form states the election in binding terms. On the last day of a claim window there is no time to change your mind afterwards, so read the election language before you submit.
What Proof or Notice ID Is Required?
Proof is required to file. The online claim form on the official settlement website opens on a login screen rather than a blank form, which means filing online depends on the credentials printed on the notice KYB's administrator sent you. An administrator-issued identifier of that kind counts as proof in its own right, because a class member who never received the notice cannot produce it — and that is true even though the $75 itself requires no receipts.On top of that, the two loss tiers require documentation connecting the loss to this incident: statements showing the fraudulent activity, invoices for a monitoring service, records of what replacing an ID cost.
If you hold a notice but cannot find the credentials, the contact route on the official settlement website is the way to reach the administrator — though on the final day of a claim window that is a thin reed, and anyone in that position should try it immediately.
What Is the Deadline?
August 26, 2026. The published materials give the date without specifying a cut-off time or a timezone, so treat the date itself as the deadline. Anyone filing on the day should use the online portal; a mailed form has no realistic chance of arriving or being postmarked in time.Once the window closes, late claims are ordinarily rejected. A class member who did not opt out stays bound by the release whether or not they filed, which is the reason a deadline like this one is worth acting on rather than reading past.
How Do You Take Action?
File on the official settlement website, KYB Data Settlement, which is the only court-authorized site for this case. Have the notice in front of you for the login credentials, decide between the flat $75 or monitoring and the documented route before you start, and upload any supporting records with the form.What Happens Next?
After the claim window closes, the Court will consider whether to grant final approval at a hearing; the date is set out in the notice on the official settlement website. A hearing being held is not the same as approval being granted, and approval is not the same as payments being released. No payment date has been announced.Separately from the settlement, anyone whose Social Security number was involved in an incident like this one should consider placing a free fraud alert or a credit freeze with the three nationwide credit bureaus, and should treat unsolicited messages referencing the breach with suspicion — breach notifications reliably attract impostors. We will update this page when the Court rules and again if a distribution date is published.
Sources and Verification
- Official settlement website — KYB Data Settlement, including the court-approved Notice, the FAQ and the Claim Form login.
- Cohen & Malad, LLP — case alert describing the February 2025 incident timeline and the notification date.
- Strauss Borrelli PLLC — investigation notice on the KYB Americas incident.
Questions
Do I have to choose between the $75 and the documented tiers?
The published settlement information presents them as alternatives. The flat $75 and the credit monitoring sit on one side as the routes that require no documentation, and reimbursement of documented ordinary losses up to $300 and documented extraordinary losses up to $5,000 sits on the other, described as what a class member can seek instead. The Claim Form is the document that states the election in binding terms, so read it on the settlement site before you submit. The choice cannot be revisited after the deadline.
Who was actually affected by the KYB breach?
The class is defined as people residing in the United States whose Personal Information was compromised in the data security incident KYB discovered in February 2025, including those who received notice of it. KYB Americas Corporation is a vehicle suspension component manufacturer based in Franklin, Indiana, so most people holding a notice are current or former employees and others whose records the company held rather than retail customers. The notice mailed from April 22, 2025 is the practical marker of membership.
What happened in the February 2025 incident?
KYB has said it detected suspicious activity on its network on February 18, 2025, and that a forensic investigation determined an unauthorized third party had access to its systems for six days, from February 11 to February 17, 2025, and took data. The ransomware group Cactus claimed responsibility for the attack; that is the group's own claim rather than a confirmed finding, and claims of that kind are frequently exaggerated. KYB began notifying affected individuals by mail on April 22, 2025.
Why is a state commercial court handling a data breach class action?
The case is Johnson et al. v. KYB Americas Corporation, Case No. 49D01-2508-CE-038312, in the Indiana Commercial Court within the Marion County Superior Court. Indiana's Commercial Court is a specialized docket for business disputes, and a class action against an Indiana company can properly sit there. For a class member the practical difference is minimal: the settlement still has to be approved by a judge, the release still binds you if you do nothing, and the claim deadline still governs.
I found this after August 26, 2026. Is there anything I can still do?
Not through this settlement. Once the claim deadline passes, late claims are ordinarily rejected, and a class member who did not opt out is still bound by the release whether or not they filed. What remains worth doing is unrelated to the settlement: place a free fraud alert or a credit freeze with the three nationwide credit bureaus, review statements for activity you do not recognize, and treat any communication referencing the breach with suspicion, since breach notifications reliably attract impostors.
