Gallagher Bassett Lawsuit: $21M Data Breach Settlement Payouts

The Gallagher Bassett lawsuit most people are searching for is In re Arthur J. Gallagher Data Breach Litigation, a consolidated class action against Arthur J. Gallagher & Co. and its wholly owned subsidiary Gallagher Bassett Services, Inc. over a 2020 ransomware attack that exposed the personal information of roughly 3.5 million people. The case settled for $21 million, and Judge Mary M. Rowland of the U.S. District Court for the Northern District of Illinois granted final approval on February 27, 2025.¹

What the Breach Exposed

Between June 3 and September 26, 2020, an unknown party accessed parts of the computer networks operated by Arthur J. Gallagher and Gallagher Bassett in what the company described as a criminal ransomware attack using the RagnarLocker variant.² The intrusion was detected on September 26, 2020.

The exposed data was extensive. According to the official settlement website, it included names, dates of birth, Social Security and tax identification numbers, driver’s license and passport numbers, financial account and credit card details, usernames and passwords, medical treatment and diagnosis records, health insurance information, and biometric data.¹ A forensic review identified approximately 3,492,654 individuals whose information may have been affected.³

Gallagher Bassett holds large amounts of personal and medical data because of what it does. As one of the world’s largest third-party claims administrators, it manages workers’ compensation, liability, and property claims for insurance carriers, self-insured employers, government entities, and large corporations.⁴

What Plaintiffs Alleged

Beginning in late 2021, multiple lawsuits were filed and then consolidated on January 10, 2022, under Master File No. 1:22-cv-00137.⁵ Plaintiffs alleged the companies failed to implement adequate safeguards — including awareness and training programs, spam filters, firewalls, and anti-malware software — to protect consumers’ information.⁶

A second core allegation was timing. Although Gallagher detected the intrusion in September 2020, it did not begin notifying affected individuals and state attorneys general until around June 30, 2021, roughly nine months later.⁶ Plaintiffs argued the delay gave bad actors more time to misuse stolen data while leaving victims unaware their information had been compromised.⁷ The court’s preliminary approval order noted that the settlement did not constitute an admission of fault, wrongdoing, or liability by the defendants.⁸

Who the Settlement Covered

The settlement class included the approximately 3,492,654 individuals who received a notification letter from Arthur J. Gallagher or Gallagher Bassett stating their information may have been affected by the breach.³ If you did not receive one of those letters, you were not a member of this class.

What Claimants Could Receive

The $21 million fund is non-reversionary, meaning it will not go back to the defendants. Class members who filed valid claims by the February 10, 2025 deadline could choose among the following benefits:³

Reimbursement of up to $6,000 per person for documented out-of-pocket losses linked to the breach, such as fraud losses, identity theft costs, credit repair fees, and professional fees. Receipts, invoices, account statements, or similar documentation were required.
Three years of three-bureau credit monitoring and identity theft insurance with at least $1 million in coverage, offered as “CyEx Identity Defense Total.”
A pro rata cash payment from the remaining fund, offered as an alternative to the monitoring services. The exact amount depends on total claims filed.
Up to $100 for California residents during the breach period under the California Consumer Privacy Act, in addition to other benefits.

A documented-loss claim could be combined with either monitoring or the cash payment, but not both.³

When Payments Are Going Out

Payments had not yet been distributed as of the most recent update on the official settlement website. The final judgment was expected to become final 30 days after the February 27, 2025 approval, at which point Kroll Settlement Administration LLC would begin calculating and issuing payments.¹ Claimants with questions can reach the settlement administrator at (833) 739-0738 or by mail at the address listed on ajgdatasettlement.com.³

Other Gallagher Bassett Lawsuits

The $21 million settlement resolves the data breach case only. It does not affect separate suits over how Gallagher Bassett handles insurance claims. In 2022, a Maricopa County, Arizona jury returned a $500,000 verdict against Gallagher Bassett and Ace American Insurance Company for bad-faith handling of a workers’ compensation claim, finding Gallagher Bassett aided and abetted the insurer in denying a copper mine worker’s claim for spinal surgery without a reasonable basis.⁹ In Mississippi, a jury awarded $250,000 to a drilling company employee who alleged that Gallagher Bassett’s bad-faith delay in processing his workers’ compensation claim contributed to the amputation of his leg; the Mississippi Supreme Court later vacated the verdict and ordered a new trial due to inconsistent jury findings.¹⁰

1
AJG Data Settlement. In Re Arthur J. Gallagher Data Breach Litigation Settlement
2
Insurance Journal. Arthur J Gallagher Says Personal Data Exposed in 2020 Ransomware Attack
3
AJG Data Settlement. In Re Arthur J. Gallagher Data Breach Litigation FAQ
4
Arthur J. Gallagher & Co. Gallagher Companies
5
CourtListener. In Re Arthur J. Gallagher Data Breach Litigation
6
Justia. In Re Arthur J. Gallagher Data Breach Litigation, Memorandum Opinion and Order
7
Insurance Business Mag. Gallagher Settles Lawsuit Over Major Data Breach
8
ClassAction.org. In Re Arthur J. Gallagher Data Breach Litigation Preliminary Approval Order
9
Doyle Law Firm. Jury Finds Ace American and Gallagher Bassett Acted in Bad Faith
10
FindLaw. Gallagher Bassett Services Inc. v. Malone