Understanding the Infosys McCamish Data Breach Settlement and Payments

If you've received a notice about the Infosys McCamish data breach settlement, you may have questions about what it means, whether you're eligible, and how payments work. This guide explains the landscape of data breach settlements and what factors shape individual outcomes. 📋

What Was the Infosys McCamish Data Breach?

In 2021, Infosys disclosed a data security incident affecting McCamish Systems, a subsidiary that manages insurance and financial services for client companies. The breach exposed personal information—including names, addresses, Social Security numbers, dates of birth, and financial account details—belonging to individuals who were customers or policy holders of McCamish's clients.

Infosys McCamish Systems is a business-to-business technology and services provider, meaning the breach didn't expose McCamish's own customers directly, but rather individuals whose data was held by McCamish on behalf of insurance companies and other financial institutions. The scope and affected population have been documented in public legal filings, though the exact number of individuals impacted has been refined through the claims settlement process.

How Data Breach Settlements Work ⚖️

When a data breach occurs, affected individuals often pursue legal action, either individually or as a class. These cases frequently result in settlement agreements rather than going to trial. Here's how the typical process unfolds:

Settlement Structure A settlement establishes a pool of money the company agrees to pay. This fund is divided among:

• Eligible claimants (individuals who can prove they were affected and meet specific criteria)
• Attorneys' fees and legal costs (typically 25–33% of the fund)
• Claims administration costs (the cost of processing and verifying claims)
• Unclaimed funds (money from individuals who don't file a claim, which may go to cy pres awards—donations to related nonprofits—or revert to the defendant, depending on the settlement agreement)

Claims-Made vs. Non-Claims-Made Most modern settlements are claims-made, meaning you must submit proof of your eligibility to receive payment. You don't automatically receive money simply because the settlement exists. You must file a claim form, typically providing identification and proof that you were affected (such as documentation from the breached company or confirmation of your account).

Who Is Eligible for Payment?

Eligibility depends on how the settlement defines affected individuals. Common criteria include:

• You had a policy, account, or relationship with one of McCamish's clients at the time of the breach
• Your personal information was confirmed to be in the breached data
• You meet any residency or jurisdictional requirements set by the settlement
• You file a claim within the deadline (usually 60–180 days from the settlement notice date)

Verification Requirements To receive payment, you'll typically need to:

• Provide your full name and identifying information
• Confirm your connection to a McCamish client
• Sign a claim form under penalty of perjury
• Meet any specific document requirements outlined in the settlement notice

The claims administration company hired to manage the settlement verifies each claim. If you're approved, you're added to the payment distribution list.

How Payment Amounts Are Determined

Settlement payment amounts vary widely depending on several factors:

Payment Ranges Data breach settlements typically award individuals anywhere from $25 to several hundred dollars per person, though this varies significantly. Some settlements with smaller affected populations or larger funds offer more. Settlements with millions of claimants and limited funds may pay smaller amounts. The claims administrator will provide specific information about expected payment ranges once the settlement is finalized.

No Guarantee of a Specific Amount You cannot know your exact payment amount until the settlement administrator calculates it after the claims deadline closes. The calculation depends on the total number of valid claims received—a factor that isn't known until the filing period ends.

What to Do If You Received a Settlement Notice

Step 1: Verify the Notice Is Legitimate Data breach scams exist. Verify that:

• The notice comes from an official claims administrator email address or settlement website (not a random email)
• You can confirm the settlement case number through court records or official settlement websites
• The contact information matches publicly listed details

Step 2: Review Your Eligibility Read the notice carefully to confirm:

• Whether you were a customer or account holder of a McCamish client at the time of the breach
• The claims deadline (this is critical—missing it typically means forfeiting your right to payment)
• What documentation you'll need to provide

Step 3: File Your Claim Submit your claim through the official settlement website or mail-in form before the deadline. Provide:

• Proof of identity
• Proof of your connection to the breached entity (account statements, policy documents, or records from the affected company)
• Any other information the settlement requires

Step 4: Monitor Your Claim Status Most claims administrators offer a way to track your claim online. You'll be notified if your claim is:

• Approved (payment will be issued)
• Denied (you'll receive an explanation)
• Pending additional information (you may need to respond with more documents)

What Happens to Unclaimed Funds?

If people don't file claims, the settlement agreement determines where the money goes. Options include:

• Cy pres awards: The remaining funds are donated to nonprofits related to privacy protection, identity theft prevention, or consumer protection
• Reversion to defendant: The money returns to Infosys (rare in modern settlements)
• Cy pres plus reversion: Nonprofits receive what can be awarded, and any remainder reverts to the defendant

The specific allocation is detailed in the settlement agreement, available through the court or claims administrator.

How to Protect Yourself After a Data Breach

Being part of a breach settlement doesn't mean you're guaranteed protection going forward. Consider:

Credit Monitoring and Fraud Alerts

• Check if the settlement includes free credit monitoring (many do)
• Place a fraud alert with credit bureaus if you're concerned about identity theft
• Review your credit reports regularly for suspicious activity

Identity Theft Insurance

• Some settlements offer free identity theft insurance for a limited period
• If not included, you may want to evaluate whether purchasing it makes sense for your situation

Account Security

• Update passwords for any accounts connected to the breached data
• Enable two-factor authentication where available
• Monitor financial and insurance accounts for unauthorized activity

Documentation

• Keep copies of your claim filing and settlement notices for your records
• Document any identity theft or fraud that occurs, as it may be relevant to future claims or disputes

Questions You May Still Have

When will I receive my payment? Payment timelines vary by settlement. After claims close, the administrator typically needs weeks to verify claims and calculate individual amounts. Payments are usually issued within a few months of the claims deadline, though this varies.

What if my claim is denied? Settlements typically allow you to appeal a denial. The notice will explain the appeal process and deadlines. Appeals usually require submitting additional documentation or clarification.

Do I owe taxes on my settlement payment? Tax treatment of data breach settlement payments varies. Some are tax-free (compensation for actual harm), while others may be taxable. Consult a tax professional about your specific situation, as the claims administrator may issue tax documentation.

What if I missed the claims deadline? Missing the deadline typically disqualifies you from payment. Some settlements allow late claims only in exceptional circumstances. If you missed the deadline, contact the claims administrator to ask if any extension or exception is possible.

Can I receive payment plus pursue my own lawsuit? Once you file a claim in a class action settlement, you generally release your right to sue independently. The settlement agreement spells out what rights you're waiving. Review this carefully before filing.

The key takeaway is this: Data breach settlements operate on a claims-made basis, meaning you must take action to receive payment. The amount you receive depends on factors beyond any individual's control, including how many other people file claims. Understanding the settlement landscape helps you make informed decisions, but your specific eligibility and payment amount depend on details unique to your situation and the settlement's terms.