The GYS data breach settlement is an $8.5 million class action resolution with the Florida law firm Gunster, Yoakley & Stewart, PA over a November 2022 breach that exposed sensitive personal information belonging to roughly 746,000 people. The court granted final approval on August 13, 2025, and the settlement administrator began issuing payments to approved claimants in January 2026.1ClaimDepot. GYS Data Breach Settlement
What Was Exposed
Gunster detected unauthorized access to its document management file system on November 27, 2022. Investigators later found the intruders had been inside the system for several weeks before discovery.2Gunster. Security Incident Notice
The compromised information included names paired with Social Security numbers, dates of birth, driver’s license and passport numbers, financial account details, and medical records covering health insurance claims and diagnosis and treatment information.2Gunster. Security Incident Notice Because Gunster held this data through its work representing clients, the exposed records ran deep.
Notification letters started going out on April 6, 2023, but the firm’s review to identify affected individuals continued long after. Some people did not receive formal notice until April 2024, roughly 18 months after Gunster discovered the breach.3ClassAction.org. Whalen v Gunster Yoakley and Steward PA Complaint
Who Was Eligible to File a Claim
The settlement class covered approximately 746,000 U.S. residents whose personal information was affected by the breach. Eligible individuals received a personalized notice containing a class member ID, which was needed to file online at GYSDataBreachSettlement.com or by mail.4ClassAction.org. Settlement Reached in Gunster Yoakley and Steward PA Data Breach Class Action Lawsuit
The claims deadline was August 2, 2025, and the opt-out deadline was July 3, 2025.1ClaimDepot. GYS Data Breach Settlement Both dates have passed, and the case is now closed to new claims.
What Claimants Could Recover
Class members had two cash tiers available:4ClassAction.org. Settlement Reached in Gunster Yoakley and Steward PA Data Breach Class Action Lawsuit
- Ordinary out-of-pocket losses up to $2,500, covering documented expenses such as credit monitoring purchases and credit report fees, plus up to seven hours of lost time at $30 per hour.
- Extraordinary losses up to $35,000 for individuals who could document actual identity theft, fraud, or other serious financial harm tied to the breach, plus up to 10 hours of lost time at $30 per hour.
The $8.5 million fund is non-reversionary, meaning nothing goes back to Gunster. If approved claims exceed the fund, payments are reduced pro rata; if claims come in below it, payments can be increased proportionally.5ClassAction.org. Whalen et al v Gunster Yoakley and Steward Settlement Agreement
In addition to cash, the settlement offered three years of three-bureau credit monitoring across Equifax, Experian, and TransUnion. That package included dark web scanning, identity theft insurance, and access to fraud resolution agents.1ClaimDepot. GYS Data Breach Settlement
Payment Timing and Case Status
Verita Global administered the settlement.6Verita Global. GYS Data Breach Class Action Settlement Payments to approved claimants began in January 2026. As of mid-2026, the case is classified as closed.1ClaimDepot. GYS Data Breach Settlement
If you filed a timely claim and have not received payment or a status update, contact the settlement administrator using the information on your original notice or through the settlement website.
What the Lawsuit Alleged
Lead plaintiff Mary Jane Whalen sued Gunster in the Southern District of Florida, raising six counts: negligence, negligence per se, breach of implied contract, breach of fiduciary duty, unjust enrichment, and violation of Florida’s Deceptive and Unfair Trade Practices Act.7Maryland State Bar Association. Law Firm Settles Data Breach Lawsuit A Warning for Legal Professionals
Whalen claimed injuries including diminished value of personal information, increased risk of identity theft and fraud, emotional distress, and out-of-pocket costs. The complaint specifically challenged the 18-month notification delay, arguing it deprived affected individuals of the chance to protect themselves sooner.8Bloomberg Tax. Floridas Gunster Yoakley Steward Firm Sued Over Data Breach Gunster resolved the claims through the settlement without an admission of liability.