The Fortra data breach settlement is final. The U.S. District Court for the Southern District of Florida approved the $20 million deal on September 15, 2025, the claim filing window closed on August 29, 2025, and payments started reaching class members in early 2026. Some claimants have reported checks around $20, well under the $85 estimate in the notice, which is common when a fixed fund is divided among a large claim pool.
What the Breach Involved
In late January 2023, the Clop ransomware group exploited a zero-day vulnerability in Fortra’s GoAnywhere Managed File Transfer software and downloaded files from more than 130 organizations over roughly ten days. The group stole data rather than encrypting systems. Information exposed included names, addresses, dates of birth, Social Security numbers, health insurance details, and member identification numbers belonging to approximately five million people.1Fortra Data Breach Settlement. Fortra File Transfer Breach Settlement – Home
The companies named as defendants were Aetna, Brightline, Community Health, Elevance Health, Fortra, Imagine360, Intellihartx, NationsBenefits, and Santa Clara. Each used GoAnywhere directly or indirectly to transfer files containing personal information.
Who the Settlement Covered
The class included all living U.S. residents who were sent a notice that their personal information may have been compromised in the breach.2Fortra Data Breach Settlement. Fortra File Transfer Breach Settlement – Frequently Asked Questions Those notices went out starting around April 2023 from whichever defendant held the affected data. People whose records were held by one of the named companies during the breach window could also qualify based on corporate records, even without a mailed notice. Claimants were grouped into subclasses tied to the specific defendant that held their information.
What the Settlement Paid
Class members who filed a valid claim by the August 29, 2025 deadline chose between two cash options and could add a year of dark web monitoring to either one.1Fortra Data Breach Settlement. Fortra File Transfer Breach Settlement – Home
- Cash Payment A reimbursed documented out-of-pocket losses up to $5,000 per person. Qualifying costs included bank fees, credit monitoring paid out of pocket, identity theft remediation expenses, postage, and local travel tied to resolving breach-related problems.
- Cash Payment B was an estimated $85 flat payment with no documentation required.
- Dark web monitoring ran for one year and could be added to either cash option.
The documented-loss tier was a single category capped at $5,000. There was no separate “extraordinary losses” tier.
When Payments Went Out and How Much
Distribution began in early 2026. Some claimants reported receiving payment in January 2026 in amounts around $20. The administrator sent payments digitally first. Claimants whose digital payment failed, or who selected a paper check from the digital payment notification email, were mailed physical checks on May 29, 2026.1Fortra Data Breach Settlement. Fortra File Transfer Breach Settlement – Home
The gap between the $85 estimate and what people actually received reflects how claims-made funds work. The settlement amount is fixed, so once the number of approved claims is tallied, the Cash Payment B pool is split among everyone who chose it. A higher-than-expected claim rate shrinks each check.
If You Filed and Haven’t Been Paid
Contact Epiq, the court-appointed settlement administrator, if your claim is still unresolved or if your dark web monitoring hasn’t been activated. Email info@FortraDataSettlement.com or call 1-888-820-3075 toll-free. Have your claim confirmation and the Unique ID from your notice ready if you still have them.
The settlement is now final. The opt-out and objection deadlines passed before the September 15, 2025 approval hearing, so no further exclusions or objections can be filed.2Fortra Data Breach Settlement. Fortra File Transfer Breach Settlement – Frequently Asked Questions Claims that were not filed by August 29, 2025 are not eligible for payment.
Tax Treatment of Your Payment
The IRS taxes settlement payments based on what the money is meant to replace. Under IRC Section 104(a)(2), only damages received on account of personal physical injuries or physical sickness are excluded from gross income. Payments for identity theft exposure, emotional distress from a breach, or reimbursement of monitoring costs do not qualify for that exclusion.3Internal Revenue Service. Tax Implications of Settlements and Judgments
For a $20 payment the tax impact is negligible. If you received a larger documented-loss reimbursement closer to the $5,000 cap, track it for your return. The administrator may issue a 1099 if total payments to you cross IRS reporting thresholds. Keep your confirmation and payment records with your tax files.
Case and Administrator Information
The litigation is styled In re: Fortra File Transfer Software Data Security Breach Litigation, Case No. 24-md-03090-RAR, in the U.S. District Court for the Southern District of Florida.
- Email: info@FortraDataSettlement.com
- Phone: 1-888-820-3075
- Website: FortraDataSettlement.com