Published
August 27, 2022
Updated
September 20, 2026
Customers who were notified by Sturm, Ruger & Co. that their information was exposed in the Freestyle Software data breach were covered by a $1.5 million class action settlement. Claims closed October 27, 2025, and a Connecticut federal judge granted final approval and dismissed the case on December 4, 2025.
Current Status
Claims are closed and the case is over. The deadline to submit a claim form was October 27, 2025. On December 4, 2025, Judge Kari A. Dooley of the U.S. District Court for the District of Connecticut granted final approval of the $1.5 million settlement and entered a judgment of dismissal with prejudice, directing the clerk to close the case. The order records that no class member objected and that three asked to be excluded.The same order awarded class counsel $500,000 in fees and $35,000 in costs, and approved service awards of $3,500 each for the four class representatives. Sturm, Ruger & Co.'s annual report filed with the SEC on March 2, 2026 states that the case was dismissed by the trial court following confirmation of a settlement, and the matter no longer appears in the company's later quarterly filings. Payments to claimants follow the settlement's effective date; no distribution date has been announced publicly.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Status
Settled · Case Closed
Final approval granted December 4, 2025
Settlement Fund
$1,500,000
Non-reversionary · also paid fees, costs, service awards and administration
Claim Deadline
October 27, 2025
Passed — the administrator no longer accepts claims
Can I Claim?
No — nothing left to file
Class members who did not opt out are bound by the release
What Happened
The breach did not happen inside Ruger's own systems. According to the court record, malware sat on servers belonging to Freestyle Software, Inc., the e-commerce software vendor that hosted ShopRuger.com, between September 18, 2020 and February 3, 2022 — roughly seventeen months. A Freestyle customer flagged a possible security problem on February 2, 2022, and Freestyle then retained Verizon to run a PCI forensic investigation; the malware was said to have been removed that month. Ruger's SEC filings refer to the same vendor by its earlier name, Freestyle Solutions, Inc.On August 18, 2022, Ruger notified affected shoppers. The settlement agreement describes the personal information collected through ShopRuger.com and other sites as including full names, addresses, credit or debit card information, and the description, price and quantity of items purchased. Notice recipients were told their personally identifiable information and payment card data may have been involved, and were offered twelve months of identity protection along with a $1 million insurance reimbursement policy.
An earlier version of this page reported that Ruger's own computers were hacked and that passwords and PINs were taken. Neither is supported by the court record, and both have been corrected above.
How the Case Was Resolved
The lead case, Jones v. Sturm, Ruger & Company, Inc., No. 3:22-cv-01233 (KAD), was filed in the District of Connecticut on October 4, 2022 and pleaded negligence, breach of implied contract and unjust enrichment. Two materially identical cases filed in the District of New Jersey were voluntarily dismissed in January 2023 and their allegations folded into an amended complaint in Connecticut.On March 27, 2024, the court granted in part and denied in part both defendants' motions to dismiss, throwing out the negligence and unjust enrichment claims against Ruger and the negligence claim against Freestyle while letting the rest of the case proceed. The parties reached agreement on settlement terms on December 6, 2024 following private mediation, and the court preliminarily approved the deal on May 15, 2025, appointing Verita Global, LLC as settlement administrator. The final approval hearing was originally set for October 24, 2025 and reset to December 4, 2025.
Both defendants denied the allegations throughout, and the settlement resolved the case without any admission of liability or wrongdoing.
Who the Settlement Covered
The settlement class was defined as all living U.S. residents who were sent a notice by Ruger saying their personal information may have been impacted in the data incident, or whose personal information was otherwise impacted or exfiltrated in it. The final approval order puts the class at roughly 183,000 people; class counsel's preliminary approval papers described it as at least 168,000. Employees, directors, officers and agents of the defendants, governmental entities, the assigned judges, their immediate families and court staff were excluded, as were class members who submitted a valid request to opt out.What the Settlement Paid
The $1.5 million fund was non-reversionary, meaning nothing went back to the defendants. It covered three kinds of payment to class members, and there was no separate cap on any one of them beyond an individual ceiling:- Reimbursement of documented out-of-pocket losses fairly traceable to the data incident, up to $4,500.
- Compensation for lost time at $25 per hour for up to five hours, a maximum of $125.
- A pro rata cash payment that class counsel estimated at $50, subject to an increase or decrease that could not push it above $175. No documentation or attestation was required for this tier.
The three could be combined, but a single class member could not recover more than $4,500 in total. Separately, Freestyle agreed to give class counsel a security attestation describing the measures it implemented after the incident, at its own expense rather than out of the fund.
Case Timeline
- September 18, 2020 – February 3, 2022: malware is on Freestyle Software's servers, which host ShopRuger.com.
- February 2, 2022: a Freestyle customer reports a possible security problem; a PCI forensic investigation follows.
- August 18, 2022: Ruger notifies affected shoppers.
- October 4, 2022: the Connecticut class action is filed.
- March 27, 2024: the court trims several claims on the motions to dismiss.
- December 6, 2024: the parties agree on settlement terms after mediation.
- May 15, 2025: preliminary approval; Verita Global appointed administrator.
- October 27, 2025: claim deadline passes.
- December 4, 2025: final approval granted, judgment entered, case closed.
What to Do Now
There is nothing left to file here, and no OCA page or law firm can reopen a claim window a court has closed. Anyone who filed a claim before the deadline should watch for a payment from the administrator and can check the official settlement website for administrator updates; class members who never filed are still bound by the release unless they opted out.A closed case does not close out the underlying exposure. Payment card data taken in 2020 and 2022 has long since been reissued for most people, but the names, addresses and purchase histories have not changed. OCA's guides on credit freezes versus fraud alerts and recovering from identity theft cover the practical steps, and the data breach settlement tracker lists every breach case with a claim window still open.
Questions
Can I still file a claim in the Ruger data breach settlement?
No. The claim deadline was October 27, 2025, and the court granted final approval and entered a judgment of dismissal on December 4, 2025. The case is closed and the settlement administrator is no longer accepting claim forms.
Whose systems were actually breached — Ruger's or a vendor's?
The court record describes malware on servers belonging to Freestyle Software, Inc., the e-commerce software vendor that hosted ShopRuger.com. Ruger sent the notice letters because the affected shoppers were its customers. Ruger's SEC filings refer to the same vendor as Freestyle Solutions, Inc.
What customer information was involved in the breach?
The settlement agreement recitals describe personal information collected through ShopRuger.com and other sites, including full names, addresses, credit or debit card information, and details of the items purchased. Notice recipients were told their personally identifiable information and payment card data may have been involved.
How much did the Ruger and Freestyle settlement pay class members?
The $1.5 million fund offered documented out-of-pocket losses up to $4,500, compensation for lost time at $25 per hour for up to five hours, and a pro rata cash payment class counsel estimated at $50 that could rise or fall but not above $175. Combined claims were capped at $4,500 per person.
What happened to class members who never filed a claim?
Anyone in the settlement class who did not ask to be excluded is bound by the release in the December 4, 2025 judgment, whether or not they filed a claim. Court records show no class member objected and three asked to be excluded.
Sources
- Final Approval Order and Judgment, ECF No. 134 (Dec. 4, 2025)
- Docket, Jones v. Sturm, Ruger & Co., Inc., No. 3:22-cv-01233 (D. Conn.)
- Memorandum in support of preliminary approval, ECF No. 119-1 (May 9, 2025)
- Memorandum of Decision on the motions to dismiss (Mar. 27, 2024)
- Official settlement website — Freestyle Data Incident Settlement
- Sturm, Ruger & Co. Form 10-K for fiscal 2025 (filed Mar. 2, 2026)
For more class actions keep scrolling below.
Status
Settled — final approval granted December 4, 2025
Settlement Amount
$1,500,000
Case Title
Jones v. Sturm, Ruger & Company, Inc.
Case Number
3:22-cv-01233 (KAD)
Court
U.S. District Court, District of Connecticut
Date Filed
October 4, 2022
Final Approval Hearing
December 4, 2025
Administrator
Verita Global, LLC
Official Website
Freestyle Data Incident Settlement.com
