People notified that their information was involved in the January 2024 cyberattack on Muscatine Power and Water's computer network may qualify to claim up to $100 for time spent responding, plus up to $5,000 for documented losses, from the $525,000 Muscatine Power and Water data breach class action settlement. Claims close October 26, 2026.
Current Status
Claims are open. The deadline to file is October 26, 2026, online or by email by that date and postmarked by it if the form is mailed, and the notice does not specify a timezone. The deadline to exclude yourself or to object is earlier, on October 9, 2026. The final approval hearing is set for December 17, 2026 at 9:00 a.m. Central Time by Zoom before the Iowa District Court for Muscatine County, and the court has not ruled on final approval. No payment date has been announced. Nothing here is paid automatically — every benefit requires a claim form, and the online form is opened with a LoginID and PIN from the notice.Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Changed Recently?
The claim process opened under a proposed settlement in Cox v. Muscatine Power and Water, Case No. 07701 CVCV027276, in the Iowa District Court for Muscatine County. Muscatine Power and Water is the municipal utility for Muscatine, Iowa, supplying electricity, water and communications service to the city, so the class here is drawn almost entirely from one community rather than from customers scattered across the country.The settlement agreement describes a data security incident carried out by a criminal entity on or around January 26, 2024, during which there was unauthorized access to the utility's computer network. Muscatine Power and Water disclosed the incident in or around March 2024, and the petition was filed on March 18, 2024. The utility moved to dismiss twice; on January 23, 2025 the court granted the motion in part and denied it in part, allowing most of the claims to proceed while dismissing the statutory ones. The parties then exchanged information informally and mediated on September 11, 2025. That session did not resolve the case, but negotiations continued and the agreement was signed in the spring of 2026.
The petition alleged negligence, invasion of privacy, breach of implied contract and unjust enrichment, along with the two Iowa statutory claims the court dismissed. Muscatine Power and Water denies each of the claims and contentions alleged against it, denies all charges of wrongdoing or liability, and the agreement states expressly that it is settling to avoid the cost and uncertainty of continued litigation rather than as an admission. No court has found that the utility did anything unlawful.
Who Qualifies?
The court has defined the class as all persons Muscatine Power and Water identified as being among those individuals impacted by the data incident, including everyone who was sent a notice of the data breach. The settlement agreement puts the class at approximately 36,995 people.Membership therefore turns on whether the utility's own records place you in the affected group, not on whether you were a customer at any particular moment. A mailed or emailed notice is the clearest sign of membership, and it is also what carries the credentials needed to file online.
The class excludes the judge in the case together with the judge's family and staff; Muscatine Power and Water and its officers, directors and related companies; and anyone who validly excludes themselves from the settlement.
How Much Can You Get?
Muscatine Power and Water will pay $525,000 into an interest-bearing escrow account, and the agreement caps its liability at that figure. Court-approved attorneys' fees and costs, a service award for the class representative, and the cost of administering the settlement come out of the fund before anything is paid to class members. What is left is the net settlement fund, and it pays the three benefits below. The documents do not estimate a per-person payment, and neither the notice nor the agreement states what administration will cost, so no reliable estimate can be drawn from them.Attested time — up to $100
Class members who spent time responding to the incident can claim up to five hours at $20 an hour. The agreement gives examples: changing passwords on potentially affected accounts, monitoring or investigating suspicious activity, contacting a provider or financial institution about it, signing up for identity theft or fraud monitoring, and researching the incident. No documentation is required for this tier — an attestation that the time was spent is enough.Out-of-pocket expenses — up to $500
Documented, unreimbursed expenses incurred because of the incident between January 26, 2024 and October 26, 2026 are payable up to $500. The notice lists fees for credit reports, credit monitoring and freezing or unfreezing credit; the cost of replacing identification documents; and postage to contact banks by mail. The agreement adds unreimbursed bank fees such as card replacement and over-limit charges, interest on short-term loans, certain phone and data charges, and gasoline for local travel.Documented extraordinary loss — up to $5,000
A class member who lost money to identity theft or fraud can claim up to $5,000 for losses in that same window. This tier asks more of a claimant than the other two: the loss has to be more likely than not traceable to the incident, it cannot already be covered by the out-of-pocket tier, and the class member has to show they tried to avoid or recover the loss, such as by using insurance they already had. Falsified tax returns are one of the examples the agreement gives of a qualifying misuse.The three tiers are cumulative rather than alternatives — the agreement says claims for attested time can be combined with the two expense tiers — but an expense already reimbursed by another source cannot be claimed at all, and the same amount cannot be claimed twice.
The order in which the fund is spent matters more here than the headline numbers. The net fund pays documented extraordinary losses and out-of-pocket expenses first; attested time is paid out of whatever remains. If approved claims exceed the fund, payments are reduced pro rata, and in that situation the agreement says no money is distributed for attested time at all. The mechanism also runs the other way: if more than 10 percent of the net fund is still unclaimed once all three benefits are allocated, the remainder is redistributed pro rata to the attested time claimants, so a payment in that tier is not necessarily capped at $100 in practice. Anything still left after that, and after a further round from uncashed checks where the average payment would be at least $3.00, goes to a court-approved charitable recipient — the parties intend to recommend Community Action of Eastern Iowa.
Class counsel will ask the court to approve fees and litigation costs of up to 33.33 percent of the fund, and a service award of up to $3,000 for the class representative. Both are paid from the same $525,000 before class members are paid, and the court can award less than either amount.
Payments go out within 30 days after the settlement becomes effective, or after all claim forms have been processed, whichever is later. Class members can elect a digital payment; anyone who does not receives a mailed check. Checks are valid for 60 days from issuance, and the agreement provides that the right to payment is forfeited once a check goes void.
What Proof or Notice ID Is Required?
Filing online requires a LoginID and PIN. The settlement website states plainly that to start the online claim form you must log in with those two credentials, and that both are printed on the notice that was sent to class members. That makes this settlement proof-required in the sense that matters most: a class member who never received the notice, or discarded it, cannot complete a claim on the website as it stands.There are two ways around it. The settlement website has a contact page for asking the administrator to resend the credentials, and a printable claim form can be downloaded and returned by mail with any supporting documentation instead. Neither changes the fact that the online route is gated.
Documentation is a separate question from the login. The attested time tier needs none — an attestation is sufficient. The two expense tiers do: the agreement calls for receipts or other records not prepared by the claimant, and says self-prepared documents such as handwritten receipts are not enough on their own, though they can be submitted to add context to real records. The documented extraordinary loss tier also requires an attestation made under penalty of perjury.
The administrator reviews claims for completeness and plausibility and has discretion over whether a claimed loss is fairly traceable to the incident. A claim found deficient gets a notice of the deficiency and a window to cure it before it is denied.
What Is the Deadline?
Claims are due October 26, 2026. A claim submitted online or by email has to be in by that date, and a mailed claim form has to be postmarked by it. The notice does not specify a timezone, so treat the date itself as the deadline rather than counting on a late-day cutoff.Two earlier deadlines both fall on October 9, 2026: the deadline to exclude yourself from the class, and the deadline to object to the settlement. A request for exclusion has to be postmarked by that date and can only cover one person — the agreement treats a request made on behalf of more than one individual as invalid. Excluding yourself keeps any right to sue Muscatine Power and Water separately over the same claims but gives up every settlement benefit. Objecting is open only to class members who stay in, and a class member can object and still file a claim.
One deadline is worth knowing about even though it is not yours to meet: Muscatine Power and Water may terminate the settlement, at its own discretion, if more than 100 class members file valid and timely exclusion requests.
How Do You Take Action?
Claims are filed on the official settlement website, Muscatine Data Breach.com, which is run by the court-appointed administrator, Simpluris. Filing means logging in with the LoginID and PIN from the notice, selecting the benefits being claimed, and uploading records for either of the two expense tiers. A printable claim form can be downloaded from the same site and returned by mail or email instead, postmarked or sent by the deadline.Anyone who cannot find their credentials can request them through the settlement website's contact page. Class members who move or change email addresses after filing should update their details the same way, because that is where a payment or a request to cure a claim would be sent. The settlement website also hosts the documents this page draws on, including the long-form notice, the claim form and the settlement agreement.
What Happens Next?
The next milestone is the final approval hearing on December 17, 2026 at 9:00 a.m. Central Time, held by Zoom. At that hearing the court will decide whether to approve the settlement, how class counsel should be paid, and whether to award the service award, and it will consider any timely objections. The notice says the date and time can change without further notice and directs class members to the settlement website for updates. Class members may attend at their own expense but are not required to, and an objection is considered whether or not the objector appears.Payments follow only if the court grants final approval and that approval becomes final, which takes longer if anyone appeals. The agreement sets the effective date no earlier than the expiry of the appeal window, and funds are deposited within 30 days after it. No payment date has been announced.
If the settlement is never approved, or is terminated under any of the provisions described above, the money is returned and the case goes back to litigation as though no class had been certified.
Sources and Verification
This page is based on the long-form notice of proposed class action settlement, the frequently asked questions and the claim form login page published on the official settlement website for Muscatine Data Breach.com, and on the Class Settlement Agreement and Release filed as Exhibit 1 in Cox v. Muscatine Power and Water, Case No. 07701 CVCV027276, Iowa District Court for Muscatine County. The agreement is the source for the class size, the procedural history, the distribution order, the redistribution and cy pres mechanics, the 100-opt-out termination threshold and the payment timing; the notice, the FAQs and the login page are the source for the deadlines, the benefit tiers and the filing requirements. The notice is embedded below.For other Iowa data-incident coverage, see OCA's page on the Iowa Medicaid data breach investigation. For a comparable settlement covering a public-sector body rather than a company, see the Arrowhead Regional Computing Consortium data breach settlement.
Questions
Can an attested time payment end up being more than $100?
It can. The $100 figure is five hours at $20 per hour, and that is the cap on the first distribution. The settlement agreement also directs that if more than 10 percent of the net fund is still unclaimed once all three benefits have been allocated, the leftover is redistributed pro rata to the class members with valid attested time claims, so that no more than 10 percent is left for the charitable recipient. A second round of payments from uncashed checks can follow on the same basis. Neither is guaranteed, and both depend on how much of the fund is claimed.
Can the three benefits be claimed together?
Yes. The settlement agreement states that claims for attested time can be combined with reimbursement for out-of-pocket expenses and for a documented extraordinary loss. They are separate tiers on one claim form rather than alternatives, and the expense tiers cannot overlap: an amount claimed as an out-of-pocket expense cannot also be claimed as an extraordinary loss.
What happens if the claims add up to more than the fund?
Payments are reduced. The agreement caps Muscatine's total liability at $525,000 and provides that if approved claims plus administration costs, attorneys' fees and expenses, and any service award exceed the fund, approved claims are cut on a pro rata basis until they fit. The agreement also says that if the fund runs short at the documented tiers, no money is distributed for attested time at all, because the net fund pays documented extraordinary losses and out-of-pocket expenses first.
What happens if a class member throws away the notice?
The LoginID and PIN are what open the online claim form, so the online route is closed without them. The settlement website has a contact page for requesting the credentials again, and it also offers a printable claim form that can be completed and returned with supporting documentation instead of filing online. A mailed claim form has to be postmarked by the claim deadline.
What information was involved in the Muscatine Power and Water incident?
The notice says files accessed during the January 2024 attack may have contained personal information such as names and Social Security numbers. The settlement agreement's definition of private information is broader, covering names, Social Security numbers and customer proprietary network information, which is the account and usage data a telecommunications provider holds. Muscatine Power and Water sells broadband and telecommunications service alongside electricity and water, which is why that category appears at all.
Can the settlement still fall apart?
It can. The agreement lets Muscatine Power and Water terminate the settlement, at its own discretion, if more than 100 class members file valid and timely exclusion requests. Either side can also terminate if the court declines to approve the settlement or materially changes its terms. If that happens, the money is returned and the case goes back to litigation as though no class had been certified.
