In re: ICCU Data Breach Litigation

Case No. CV03-20-00831

Sixth Judicial District Court for the State of Idaho

Frequently Asked Questions

z

  1. BASIC INFORMATION AND OVERVIEW

  2. Why did I get a Notice?

    If you received a notice it is because ICCU previously sent you notice that your personal information was or may have been compromised in a data breach initially disclosed by ICCU in or about February 2020. A Court authorized the notice because you have a right to know how the proposed settlement may affect your rights. The notice explains the nature of the litigation, the general terms of the proposed settlement and what it may mean to you. The notice also explains the ways you may participate in, or exclude yourself from, the Settlement.

    Para notificación en español, haga clic aqui.

  3. What is this lawsuit about?

    On February 24 and February 26, 2020, two proposed class action lawsuits - Kyle Nelson v. Idaho Central Credit Union, Case No. CV03-20-00831 (the “Nelson Action”) and Christie L. Lewis; Michael L. Lewis v. Idaho Central Credit Union, Case No. CV01-20-3733 (the “Lewis Action”) - were filed against ICCU in the Fourth and Sixth Judicial Districts, respectively, of the State of Idaho relating to two data breaches disclosed by ICCU on or about February 6, 2020, potentially affecting certain personal information of current and former ICCU customers (the “Data Breach”).

    Thereafter, the court entered an order consolidating the Nelson and Lewis Actions before the Honorable Robert C. Naftz, in the District Court of the Sixth Judicial District of the State of Idaho, in and for the County of Bannock under Master Case No. CV03-20-00831. The Court consolidated the cases to proceed together under the caption In re: ICCU Data Breach Litigation, under Master Case No. CV03-20-00831. The individuals who sued are called the “Plaintiffs.” ICCU is the “Defendant.” Plaintiffs claim that ICCU did not adequately protect their personal information. The Order Granting Stipulated Motion to Consolidate Cases can be viewed by clicking here.

    ICCU denies any wrongdoing, and no court or other entity has made any judgment or other determination of any wrongdoing.

  4. Why is this a class action?

    In a class action, one or more people called “class representatives” sue on behalf of themselves and other people with similar claims. All of these people together are the “class” or “class members.” Because this is a class action, even persons who did not file their own lawsuit can obtain relief from harm that may have been caused by the Data Breach, except for those individuals who timely exclude themselves from the Settlement Class.

  5. Why is there a Settlement?

    The Court has not decided in favor of Plaintiffs or ICCU. Instead, both sides agreed to a settlement. Settlements avoid the costs and uncertainty of a trial and related appeals, while more quickly providing benefits to members of the Settlement Class. The class representatives appointed to represent the class and the attorneys for the Settlement Class (“Class Counsel,” see FAQ 15) believe that the Settlement is in the best interests of the Settlement Class Members

  6. WHO IS PART OF THE SETTLEMENT

  7. How do I know if I am part of the Settlement?

    You are a member of the Settlement Class if you received notice from ICCU that your personal information was or may have been compromised in the data breach initially disclosed by ICCU in or about February 2020, or you received this settlement notice stating that you or your dependent(s) are class members.

    Excluded from the Settlement are:

    • ICCU and its officers, directors, legal representatives, successors, subsidiaries, and assigns;
    • The presiding judge and any judicial staff or immediate family members; and
    • Any Settlement Class Member who excludes himself or herself from the Settlement (see FAQ 18).

    If you are not sure whether you are included in the Settlement Class, contact the Settlement Administrator by email at info@ICCUDataBreachSettlement.com or by phone at call 1-833-640-0650.

  8. THE SETTLEMENT BENEFITS

  9. What does the Settlement Provide?

    Under the Settlement, ICCU will pay $1,550,000.00 into a Settlement Fund that will be used to provide the following benefits:

    • Cash reimbursement for Out-of-Pocket Losses fairly traceable to the Data Breach (see FAQ 8);
    • Cash reimbursement for Attested Time spent remedying issues related to the Data Breach (see FAQ 8);
    • Additional Cash Payments (see FAQ 10); and
    • Attorneys’ fees and expenses as approved by the Court (see FAQ 16), service awards for the class representatives as approved by the Court (see FAQ 17), and the costs of notifying the class and administering the Settlement.

    Depending on the number of valid claims, the costs of settlement administration, and the amount awarded by the Court for attorney’s fees and costs and service payments, payments for certain benefits may be reduced proportionally or withheld as set forth in paragraph 63 of the Settlement Agreement.

    Separate and apart from the Settlement Fund, ICCU has agreed to provide credit monitoring and identity theft restoration services through Kroll. These services include daily credit monitoring, a $1 million identity theft insurance policy; identity theft restoration services; and other additional features.

    As part of the Settlement, ICCU has also agreed to equitable relief including certain security enhancements, provision for identity protection services, training, and increased staffing (see FAQ 11).

  10. Will ICCU know if I submit a claim for settlement benefits?

    No. As part of the Settlement Agreement, ICCU will not have access to the identities of Settlement Class Members who make claims for any of the benefits provided by this Settlement.

  11. How will the Settlement compensate me for identity theft and fraud I have already suffered or expenses I have already paid to protect myself?

    Settlement Benefit: Payment for Unreimbursed Out-of-Pocket Losses: If you spent money to address fraud or identity theft or to protect yourself from future harm that is fairly traceable to the Data Breach, then you can submit a claim for reimbursement. Out-of-Pocket losses that are eligible for reimbursement through the Settlement may include, but are not limited to, the following costs related to the Data Breach and incurred after February 1, 2020:

    1. Compensation for Ordinary Losses: ICCU will provide compensation for unreimbursed losses, up to a total of $1,000.00 per person, upon submission of a claim and supporting documentation, such as the following losses:
      1. Out of pocket expenses incurred as a result of the ICCU Data Breach, including bank fees, long distance phone charges, cell phone charges (only if charged by the minute), data charges (only if charged based on the amount of data used), postage, or gasoline for local travel;
      2. Fees for additional credit reports, credit monitoring, or other identity theft insurance products purchased between February 1, 2020 and the date of the Preliminary Approval Order;
      3. Up to 40 hours of lost time, at $25/hour, if at least one full hour was spent dealing with the Data Breach (claims for lost time are included within the $1,000 cap on ordinary losses). For lost time, a sworn attestation detailing how the time was spent shall constitute "supporting documentation.”
    2. Compensation for Extraordinary Losses: ICCU will provide up to $20,000.00 in compensation to each Settlement Class Member for proven monetary loss including, but not limited to, losses arising from financial fraud or identity theft if:
      1. The loss is an actual, documented, and unreimbursed monetary loss;
      2. The loss is fairly traceable to the Data Breach;
      3. The loss is not already covered by one or more of the normal reimbursement categories; and
      4. The settlement class member made reasonable efforts to avoid, or seek reimbursement for, the loss.

    This list provides examples only, and other losses or costs traceable to the Data Breach may also be eligible for reimbursement. YOU MUST BE ABLE TO DOCUMENT YOUR CLAIM.

    The Settlement Administrator has the sole authority to determine the validity of claims for Out-Of-Pocket Losses. Only valid claims will be paid. The deadline to file a claim for Out-of-Pocket Losses is April 19, 2021 (this is the last day to file online and the postmark deadline for mailed claims).

  12. How will the Settlement help protect me against future identity theft and fraud?

    Settlement Benefit: Credit Monitoring Services: ICCU shall offer to all Settlement Class Members twelve (12) months of Credit Monitoring Services at no cost, regardless of whether the Settlement Class Member submits a claim for Ordinary or Extraordinary Losses. These services will include daily credit monitoring of the Settlement Class Member’s credit file at Experian; a $1 million identity theft insurance policy; identity restoration services; and other additional features (“Credit Monitoring and Identity Restoration Services”). Class Members who already accepted the credit monitoring services offered by ICCU in the notification about the Data Breach will automatically receive the extra twelve (12) months extension of credit monitoring. For all other Class Members, such Credit Monitoring and Identity Restoration Services shall be provided to on an opt-in basis (i.e., Settlement Class Members must submit a claim for the services to receive them).

  13. What if I already have credit monitoring or identity protection services?

    Settlement Benefit: Additional Cash Payments from Net Settlement Fund: Even if you have no out-of-pocket losses and do not wish to make a claim for credit monitoring services, you still may recover under the terms of the Settlement Agreement. From the monies remaining in the Settlement Fund after all payments are made for Ordinary Losses, Extraordinary Losses, and attorneys’ fees and litigation expenses including settlement administration fees (“Remaining Funds”), an additional cash payment will be paid to each Settlement Class Member to be calculated by dividing the Remaining Funds by the number of Settlement Class Members, subject to an individual aggregate cap of $20,000 for total payments under the Settlement. For example, if 20% of the Settlement Class Members submit a valid claim for reimbursement for Out-of-Pocket Losses and Attested Time, Settlement Class Members claiming this benefit will likely receive a minimum cash payment of at least $50. If 10% or less of Settlement Class Members submit a valid claim for reimbursement for Out-of-Pocket Losses and Attested Time, the Additional Cash Payments will likely exceed $150 per claimant. If the claims rate exceeds 25%, then Additional Cash Payments may be significantly reduced or withheld. For your reference, in many class action settlements only 5-10% of eligible class members submit valid claims. If you have questions regarding this benefit, you may contact Class Counsel as provided for in FAQ 15.

  14. Will the Settlement include changes to ICCU’s data security program?

    Settlement Benefit: Data Security Business Practice Commitments by ICCU: ICCU has agreed that in response to the Data Breach, it has employed information security enhancements including external review of security controls, implemented whitelisting and multifactor authentication where possible for third party system access; provisioned for free identity protection services for those impacted; increased training of all ICCU team members regarding cybersecurity; reviewed security posture and updated risk assessments for all ICCU vendors and implemented additional controls upon them, where possible; implemented dark web data scans searching for ICCU data; and increased staff in the following areas: Vendor Management, Audit and Compliance.

  15. HOW TO GET SETTLEMENT BENEFITS

  16. How do I file a claim for Credit Monitoring Services, Alternative Cash Payment, Attested Time, and/or Out-of-Pocket Losses?

    To submit a claim for Out-of-Pocket Losses or Attested Time fairly traceable to the Data Breach, and/or Credit Monitoring Services, you will need to file a claim form. There are two options for filing claims:

    1. File Online: You may fill out and submit the claim form online by clicking here. This is the quickest way to file a claim.
    2. File by Mail: Alternatively, you may fill out the claim form attached to this notice and mail it to the address on the form with supporting documentation, if any. If you lost or did not otherwise receive a claim form, you can download a hard copy of the claim form by clicking here, or ask the Settlement Administrator to mail a claim form to you by calling 833-640-0650. Fill out your claim form and mail it (including postage) to: In re: ICCU Data Breach Litigation c/o Settlement Administrator, 1650 Arch Street, Suite 2210, Philadelphia, PA 19103.

    The deadline to file a claim is April 19, 2021 (this is the last day to file online and/or the postmark deadline for mailed claims).

    Additional cash payments, if available, will be made automatically. You do not need to make a claim to be eligible for an additional cash payment.

  17. When and how will I receive the benefits I claim from the Settlement

    Credit Monitoring Services claimed by Settlement Class Members will begin, and payments for valid claims will be made, after the Court enters the Final Approval Order and Judgment and the Settlement becomes final. This process may take several months or longer if there is an appeal; please be patient. Once there is a Final Approval Order and Judgment, it will be posted on this website.

    If you make a claim for Credit Monitoring Services, the Settlement Administrator will send you information on how to activate your credit monitoring once the Settlement is final. The Settlement Administrator will provide you with an activation code that you will use at the Kroll website to activate the applicable Credit Monitoring Services. The activation code(s) will remain valid for at least 60 days.

    Checks for valid claims for Out-of-Pocket Losses, Attested Time and Additional Cash Payments either will be mailed by the Settlement Administrator to the mailing address that you provide, or will be provided through PayPal or Venmo at your election.

  18. LEGAL RIGHTS RESOLVED THROUGH THE SETTLEMENT

  19. What happens if I do nothing and what am I giving up to stay in the settlement class?

    If you make a claim under the Settlement, or if you do nothing, you will be releasing all of your legal claims against ICCU arising out of the issues this Settlement resolves. Unless you exclude yourself from the Settlement (see FAQ 18), all of the decisions by the Court will bind you. The specific claims you are giving up against ICCU are described in Section XIII of the Settlement Agreement, which can be viewed by clicking here. You will be releasing ICCU and all related people as described in Section XIII of the Settlement Agreement.

    The Settlement Agreement describes the released claims with specific descriptions, so read it carefully. If you have any questions regarding the release, you may contact Class Counsel as provided for in FAQ 16.

  20. THE LAWYERS REPRESENTING YOU

  21. Do I have a lawyer in the case?

    Yes. The Court appointed the following attorneys to represent you and other Settlement Class Members as “Class Counsel.”

    Gary Klinger
    MASON LIETZ & KLINGER LLP
    227 W. Monroe Street, Suite 2100
    Chicago, IL 60606     		Benjamin Schwartzman
    ANDERSON SCHWARTZMAN WOODARD DEMPSEY, PLLC
    800 West Main Street, Suite 1460
    Boise, ID 83702
    Hassan Zavareei
    TYCKO & ZAVAREEI LLP
    1828 L Street, NW, Suite 1000
    Washington, DC 20036     		Brandon Wise
    PEIFFER WOLF CARR KANE & CONWAY
    818 Lafayette Avenue, 2nd Floor
    St. Louis, MO 63104

    You will not be charged by these lawyers for their work on the case. If you want to be represented by your own lawyer, you may hire one at your own expense. If you have questions about how to submit a claim or if you need to update your address information, please contact the Settlement Administrator (see FAQ 20).

  22. How will these lawyers be paid?

    Class Counsel have undertaken this case on a contingency-fee basis and have not been paid any money in relation to their work on this case to date. Accordingly, Class Counsel will ask the Court to award them attorneys’ fees not to exceed 33 1/3% of the total settlement amount, and reimbursement for costs and expenses to be paid from the Settlement Fund. You will not have to separately pay any portion of these fees yourself. The Court will decide the amount of fees and costs and expenses to be paid. Class Counsel’s request for attorneys’ fees and costs (which must be approved by the Court) will be filed by March 1, 2021 and will be available to view on this website.

  23. Will the class representatives receive any additional money?

    The class representatives are listed in the Settlement Agreement, which can be viewed by clicking here. Class Counsel will ask the Court to award these individuals Service Award Payments of $5,000.00 for the time that they spent, and the risks that they undertook, in bringing this lawsuit on behalf of the class. This amount is also subject to Court approval. Any amount approved by the Court will be paid from the Settlement Fund. Class Counsel’s request for these Payments (which must be approved by the Court) will be filed by March 1, 2021 and will be available to view on this website.

  24. EXCLUDING YOURSELF FROM THE SETTLEMENT

  25. How do I exclude myself from the Settlement?

    If you are a member of the settlement class but do not want to remain in the class, you may exclude yourself from the class (also known as “opting out”). If you exclude yourself, you will lose any right to participate in the Settlement, including any right to receive the benefits outlined in this Notice.

    If you decide on this option, you may keep any rights you have, if any, against ICCU and you may file your own suit against ICCU based upon the same legal claims that are asserted in this lawsuit, but you will need to find your own attorney at your own cost to represent you in that lawsuit. If you are considering this option, you may want to consult an attorney to determine your options.

    To exclude yourself from the Settlement, you must mail a request for exclusion, postmarked no later than April 19, 2021, to:

    Class Action Opt-Outs
    ATTN: In re: ICCU Data Breach Litigation
    PO Box 58220
    Philadelphia, PA 19102

    This statement must contain the following information:

    1. The name of this proceeding (In re: ICCU Data Breach Litigation, Case No. CV03-20-00831 or similar identifying words such as “ICCU Data Breach Lawsuit”);
    2. Your full name and address;
    3. The words “Request for Exclusion” at the top of the document or a statement that you do not wish to participate in the settlement; and
    4. Your signature.

    If you do not comply with these procedures and the deadline for exclusions, you will lose any opportunity to exclude yourself from the settlement class, and your rights will be determined in this lawsuit by the Settlement Agreement if it is approved by the Court, and you may not recover under any other individual settlement agreement regarding the claims released as part of the Settlement.

  26. OBJECTING OR COMMENTING ON THE SETTLEMENT

  27. How do I tell the Court that I don’t like the Settlement?

    If you are a Settlement Class Member, you can object to the Settlement if you don’t think it is fair, reasonable, or adequate, including Class Counsel’s motion for an award of attorneys’ fees and costs and expenses, and/or the requested service award payments to the Settlement Class Representatives. The Court cannot order a larger settlement or award you more based on your individual circumstances; the Court can only approve or deny the Settlement as it is presented.

    To object, you must send a letter stating that you object to the Settlement. Your objection must include:

    1. The name of this proceeding (In re: ICCU Data Breach Litigation, Case No. CV03-20-00831 or similar identifying words such as “ICCU Data Breach Lawsuit”);
    2. Your full name, address, and telephone number;
    3. State with specificity the grounds for the objection, as well as any documents supporting the objection;
    4. A statement as to whether the objection applies only to you and your circumstances, to a specific subset of the class, or to the entire class;
    5. The name and address of any attorneys representing you with respect to the objection;
    6. A statement regarding whether you or your attorney intend to appear at the Final Approval Hearing; and
    7. You or your attorney’s signature.

    To be considered by the Court, your objection must be mailed, postmarked no later than April 19, 2021, to the following address:

    Class Action Objections
    ATTN: ICCU Data Breach Litigation
    PO Box 58220
    Philadelphia, PA 19102

    You must not submit your objections directly to the Court. If you do not comply with these procedures and the deadline for submitting objections, you may lose any opportunity to have your objection considered at the Final Approval Hearing or otherwise to contest the approval of the Settlement or to appeal from any orders or judgments entered by the Court in connection with the proposed settlement. You will still be eligible to receive settlement benefits if the Settlement becomes final even if you object to the Settlement.

    The Court has scheduled a Final Approval Hearing to listen to and consider whether the Settlement is fair, adequate, and reasonable. If there are objections, the Court will consider them.

    The hearing will take place on June 1, 2021 at 2:30 pm before the Honorable Robert C. Naftz, at the Sixth Judicial District Court, State of Idaho, 624 E Center St # 220, Pocatello, Idaho 83201. This hearing date and time may be moved or may be conducted telephonically or by video conference. Please refer to the settlement website for notice of any changes.

  28. GETTING MORE INFORMATION

  29. Where can I get more information?

    This website summarizes the Settlement. More details are in the Settlement Agreement. You can get a copy of the Settlement Agreement and other case documents by visiting the Important Documents page of this website. If you have questions about the Notice or the Settlement, you may contact the Settlement Administrator by email at info@ICCUDataBreachSettlement.com, by phone at 1-833-640-0650, or by mail at In re: ICCU Data Breach Litigation, c/o Settlement Administrator, 1650 Arch Street, Suite 2210, Philadelphia, PA 19103.

    If you wish to communicate directly with Class Counsel, you may contact them (see FAQ 15). You may also seek advice and guidance from your own private attorney at your own expense, if you wish to do so.

    The status of the settlement, any appeals, and the date of payments will be posted on the Settlement website.

    The Court cannot respond to any questions regarding this Notice, the lawsuit, or the proposed settlement. Please do not contact the Court or its Clerk with questions about the Settlement.