Frequently Asked Questions

The Court authorized this Settlement Website because you have a right to know about the settlement, and all of your options, before the Court decides whether to give “final approval” to the settlement. This Settlement Website explains the nature of the Litigation that is the subject of the settlement, the general terms of the settlement, and your legal rights and options.

Hon. Melissa R. McCormick of the Superior Court for the State of California for the County of Orange is overseeing this case captioned as Kimco Staffing Data Breach Cases, Judicial Council Coordination Proceeding No. 5321. The people who brought the Litigation are called the Plaintiffs. The company being sued, Kimco Staffing Services, Inc. (“Kimco”), is called the "Defendant".

The Litigation alleges that on or about June 24, 2023, Kimco experienced a cyberattack in which unauthorized individuals infiltrated Kimco’s computer network and gained access to specific personal data, including the personally identifiable information or "PII" of approximately 69,687 individuals, called the Data Incident. Plaintiffs allege that during the Data Incident, cybercriminals potentially accessed and/or exfiltrated sensitive Private Information, including names, Social Security Numbers, financial account information, and payment card information, belonging to Plaintiffs and Settlement Class Members. Plaintiffs and Settlement Class Members received notices of the Data Incident in or around December of 2023.

Defendant denies these claims and say they did nothing wrong. No court or other judicial entity has made any judgment or other determination that Defendant has done anything wrong.

In a class action, one or more people called “Class Representatives” or Plaintiffs sue on behalf of all people who have similar claims. Together, all of these people are called a “Settlement Class,” and the individuals are called “Settlement Class Members.” One court resolves the issues for all Settlement Class Members, except for those who exclude themselves from the Settlement Class.

The Court has not decided in favor of the Plaintiffs or Defendants. Instead, both sides agreed to the settlement. The settlement avoids the cost and risk of a trial and related appeals, while providing benefits to Settlement Class Members. The Class Representatives appointed to represent the Settlement Class, and the attorneys for the Settlement Class, "Class Counsel", (see Question 18) think the settlement is best for all Settlement Class Members.

You are affected by the settlement and potentially a Settlement Class Member if you are an individual who resided in the United States whose Private Information was exposed in the Data Incident involving Defendant, including all who were sent notice of the Data Incident.

The Settlement Class specifically excludes: (i) Defendant; (ii) any entity in which Defendant has a controlling interest, is a parent or subsidiary, or which is controlled by Defendant; (iii) the affiliates, legal representatives, attorneys, heirs, predecessors, successors, and assigns of Defendant; (iv) the judges and court personnel in this case and any members of their immediate families; and (v) any Settlement Class Member who timely and validly submits an opt-out notice.

If you are not sure whether you are included in the settlement, you may call (833) 876-1553 or email [email protected] with questions. You may also write with questions to:

Kimco Data Incident Litigation
c/o Kroll Settlement Administration LLC
P.O. Box 225391
New York, NY 10150-5391

All Settlement Class Members shall have the opportunity to submit a Claim Form for certain claimed benefits. The claimed benefits, as described below, shall include (a) Credit Monitoring and Identity-Protection Services; (b) Out-of-Pocket Losses; (c) CCPA payments; and (d) Pro Rata Cash Payments. You may submit a Settlement Claim for one or all of the settlement benefits.

Business Practice Enhancements: Kimco has implemented and will maintain reasonable protocols to secure personal information within its network. As part of those efforts, Kimco agrees that it has taken or will take the following measures in the future: 
 

1. Sentinel One Complete Endpoint Protection via Arete Managed Detection & Response (MDR): Provides 24/7 cybersecurity expert monitoring of Kimco’s network through autonomous, AI-driven endpoint threat detection and that will deploy an immediate response to mitigate potential threats (EDR). Integrated Ranger Network Visibility and Control offers unparalleled insight into unmanaged and IoT devices, ensuring no blind spots in Kimco’s network.
2. Rapid7InsightVM: Continuous and dynamic vulnerability management with actionable insights into risks across our Kimco’s infrastructure. The software’s integrated remediation workflows streamline the process of patch management and vulnerability resolution, improving operational efficiency.
3. Varonis: Empowers Kimco with real-time visibility into sensitive data access and user behaviors. By identifying potential insider threats and minimizing unnecessary data exposure, Varonis effectively reduces the blast radius of any security incident. Its proactive threat detection platform ensures that suspicious activities are flagged and addressed before they escalate.
4. Trend Micro Vision One: This cloud email and collaboration protection platform shields Kimco’s email systems and collaboration tools (e.g., Microsoft 365) from phishing, malware, and business email compromise (BEC). Its extended detection and response (XDR) capabilities enhance our ability to correlate events across multiple vectors, providing a unified view of threats.
5. Zerto Disaster Recovery Solution: Ensures the resilience of Kimco’s critical systems by enabling near-instant recovery of data and applications. This solution reduces downtime and data loss during unforeseen disruptions, safeguarding Kimco business continuity.
6. On-Premise Surveillance Camera System: Enhances physical security by monitoring critical locations and providing a deterrent against unauthorized access. This system integrates with our broader security framework for cohesive incident management.
7. Increased Comprehensive Security Review and Penetration Testing: Increased frequency of independent third-party penetration testing and end-to-end internal and external security reviews to ensure that all layers of Kimco’s cybersecurity infrastructure are tested, validated, and optimized against current threat landscapes.
8. Policy and Response Plan Updates: Conducted a thorough review and, where necessary, updates to all internal security policies and incident response plans to ensure alignment with current industry standards and best practices. These revisions enhance our preparedness and ensure a swift, coordinated response to potential future incidents.
9. Upgraded IT Infrastructure and End-User Devices: Reviewed and upgraded all desktop computers, laptops, and tablets to ensure they meet the latest security and performance standards. Additionally, key data center switches and routers were upgraded to enhance network reliability, performance, and security. These improvements minimize vulnerabilities in endpoint devices and core network infrastructure, ensuring a stronger, more resilient IT environment.
    

Kimco acknowledges that the business practice changes already implemented were implemented in substantial part due to the pending Litigation and/or this settlement. The cost of the Business Practice Enhancement being implemented and/or maintained is approximately $400,000. The costs of the Business Practice Enhancement are to be paid by Defendant separately and apart from the Settlement Fund.
 

Settlement Class Members may submit a Settlement Claim to receive any or all of the settlement benefits:
 

1. Credit Monitoring and Identity-Protection Services, and $1,000,000 Identity Theft Insurance – All Settlement Class Members who submit a valid Claim Form will receive access to Credit Monitoring and Identity-Protection Services, including $1,000,000 in Identity Theft Insurance for a period of two (2) years from the date a Settlement Class Member claims the offer as provided on the Short Notice. Any Settlement Class Member who submits a Valid Claim for any benefit will receive this benefit;
   • The Credit Monitoring and Identity-Protection Services will include a minimum of the following features: (i) credit monitoring; (ii) identity theft insurance (with a $1,000,000 policy limit); (iii) real-time credit monitoring services; and (iv) access to fraud resolution agents. The costs for these services will be paid from the Settlement Fund.
2. Reimbursement for any Documented Out-of-Pocket Losses – Every Settlement Class Member may submit a Settlement Claim for up to $5,000 for out-of-pocket expenses and losses including proven actual monetary losses, upon submission of a valid Claim Form provided that:
   1. the loss is an actual, unreimbursed monetary loss is supported by third-party documentation;
   2. the loss is fairly traceable to the Data Incident;
   3. the claimant made reasonable efforts to avoid the loss or seek reimbursement for the loss, including, but not limited to, exhaustion of all available credit monitoring insurance and identity theft insurance; and 

   4. the actual misuse or fraud loss occurred between June 24, 2023, and December 16, 2026. 

       

   • Losses may include, without limitation, the following:
     1. out-of-pocket expenses incurred as a result of the Data Incident, including bank fees, long distance phone charges, cell phone charges (only if charged by the minute), data charges (only if charged based on the amount of data used), postage, or gasoline for local travel, fees for credit reports, credit monitoring, or other identity theft insurance product; and 

     2. other expenses fairly traceable to the Data Incident.

         

   • Settlement Class Members who elect to submit a Settlement Claim for reimbursement of Out-of-Pocket Losses must provide to the Settlement Administrator information required to evaluate the claim, including: (i) the Settlement Class Member’s name and current address; (ii) documentation reasonably supporting their claim; and (iii) a brief description of the nature of the loss, if the nature of the loss is not apparent from the documentation alone. 

      

   • Documentation supporting Out-of-Pocket Losses can include receipts or other documentation not “self-prepared” by the Settlement Class Member concerning the costs incurred. “Self-prepared” documents such as handwritten receipts are, by themselves, insufficient to receive reimbursement, but can be considered to clarify or support other submitted documentation.

      

   • Out-of-pocket losses will be deemed “fairly traceable” if: (1) the timing of the loss occurred on or after the respective Data Incident, and (2) in the Settlement Administrator’s sole determination, the Out-of-Pocket Losses could reasonably be caused by either of the Data Incident. Settlement Claims for Out-of-Pocket Losses may be reduced pro rata if insufficient funds remain in the Settlement Fund after the payment of Attorneys’ Fees and Expenses Award, any Service Award, and the Costs of Claims Administration.

3. CCPA payment – all Settlement Class Members who resided in California on June 24, 2023, may submit a Settlement Claim to receive a cash payment of $50. Settlement Class Members who make a Valid Claim for the CCPA payment will also be entitled to make a Settlement Claim for Out-of-Pocket Losses, Pro Rata Cash Payment, and Credit Monitoring and Identity-Protection Services; AND
    

4. Pro Rata Cash Payment – Following the payment of any Attorneys’ Fees and Expenses Award, any Service Award, the Costs of Claims Administration, the cost of Credit Monitoring and Identity-Protection Services, claims for Out-of-Pocket Losses, and CCPA Payments, any remaining amount in the Settlement Fund shall be distributed on a pro rata or equal share basis to all Settlement Class Members who submitted Valid Claims.

To receive a benefit under the settlement, you must complete and submit a Settlement Claim online here, or by mail to Kimco Data Incident Litigation, c/o Kroll Settlement Administration LLC, P.O. Box 225391, New York, NY 10150-5391. Read the Claim Form instructions carefully, fill out the Claim Form, provide the required documentation, and submit online by Tuesday, December 15, 2026 or by mail postmarked by Tuesday, December 15, 2026.

The Court will hold a hearing February 18, 2027, at 2.00 p.m. PT to decide whether to approve the settlement. If the Court approves the settlement, there may be appeals from that decision and resolving them can take time, perhaps more than a year. It also takes time for all of the Claim Forms to be processed. Please be patient.

The Released Persons gets a release from all claims covered by this settlement. Thus, if the settlement becomes final and you do not exclude yourself from the settlement, you will be a Settlement Class Member and you will give up your right to sue Defendant, Defendant’s employees, and Defendant’s insurer The Travelers Companies, Inc. for Released Claims. These Released Claims are any and all claims, causes of action, and demands that were or reasonably could have been asserted by a Settlement Class Member against any of the Released Persons based on the facts alleged in the operative complaint in this Litigation. If you have any questions, you can talk to the law firms listed in Question 17 for free or you can talk to your own lawyer.

No. If you exclude yourself, you will not be entitled to receive any benefits from the settlement and you will not be bound by any Final Judgment Order.

No. Unless you exclude yourself, you give up any right to sue any Released Persons for the Released Claims that this settlement resolves. You must exclude yourself from the settlement to start your own lawsuit or to be part of any different lawsuit relating to the claims in this case. If you exclude yourself, do not submit a Claim Form to ask for any benefit under the settlement.

To exclude yourself, complete the Exclusion Form available here. The form must be personally signed by the Settlement Class Member (with a physical ink signature or via DocuSign, or other similar process for transmitting authenticated digital signatures) and (a) timely mailed it with a postmark by November 16, 2026 to the Settlement Administrator at the designated address below, or (b) emailed it to the Settlement Administrator using the email address provided below. 

To be effective, the Exclusion Form must include the following: (a) the requestor’s name, address, and email address; and (b) the requestor’s physical ink or digitally authenticated signature. You must email the opt-out notice to [email protected] by November 16, 2026, or mail your opt-out notice postmarked by November 16, 2026 to:
 

Kimco Data Incident Litigation
c/o Kroll Settlement Administration LLC
P.O. Box 225391
New York, NY 10150-5391

You can tell the Court that you do not agree with the settlement or some part of it by objecting to the settlement. To object, you must complete and submit an Objection Form, document available here. The Objection Form must be emailed to [email protected] or postmarked to the address of the Settlement Administrator below on or before the November 16, 2026:

Kimco Data Incident Litigation
c/o Kroll Settlement Administration LLC
P.O. Box 225391
New York, NY 10150-5391

Your objection must be written and must include all of the following: 

1. the objector’s full name and address;
2. the case name and number, Kimco Staffing Data Breach Cases, Judicial Council Coordination Proceeding No. 5321;
3. information identifying the objector as a Settlement Class Member, including proof that the objector is a member of the Settlement Class (e.g., copy of the objector’s settlement notice, copy of original notice of one or both of the Data Incident, or a statement explaining why the objector believes he or she is a Settlement Class Member);
4. a written statement of all grounds for the objection, accompanied by any legal support for the objection the objector believes applicable;
5. the identity of any and all counsel representing the objector in connection with the objection;
6. a statement whether the objector and/or his or her counsel will appear at the Final Approval Hearing;
7. a list of any other objections submitted by the Settlement Class Member or Settlement Subclass Member, or their counsel, to any class actions submitted in any court, whether state, federal, or otherwise, in the United States in the previous five (5) years; and
8. the objector’s signature or the signature of the objector’s duly authorized attorney or other duly authorized representative (if any) representing him or her in connection with the objection.
    

Objecting is telling the Court that you do not like the settlement and why you do not think it should be approved. You can object only if you are a Settlement Class Member. Excluding yourself is telling the Court that you do not want to be part of the Settlement Class and do not want to receive any payment from the settlement. If you exclude yourself, you have no basis to object because you are no longer a Settlement Class Member, and the case no longer affects you.

Yes. The Court has appointed John J. Nelson of Milberg Coleman Bryson Phillips Grossman, PLLC and Jason M. Wucetich of Wucetich & Korovilas LLP as Class Counsel to represent the Settlement Class in settlement negotiations. If you want to be represented by your own lawyer, you may hire one at your own expense.

Class Counsel will file an application to be paid from the $640,000 Settlement Fund. Class Counsel will request an Attorneys’ Fees and Expenses Award in an amount not to exceed one third (1/3) of the Settlement Fund ($213,333.33), and reimbursement of documented costs and expenses of an amount not to exceed $45,000. Defendant has agreed to pay from the Settlement Fund any Attorneys’ Fees and Expenses Award up to those amounts, to the extent approved by the Court. Any such award would compensate Class Counsel for investigating the facts, litigating the case, and negotiating the settlement and will be the only payment to them for their efforts in achieving this settlement. The costs of administering the Settlement and providing Notice to the Class will also be paid from the $640,000 Settlement Fund. These costs will be capped at $97,000.

Class Counsel will also ask the Court for a Service Award up to $2,500 for each of the Class Representatives to be paid from the $640,000 Settlement Fund. The amount of the Service Award shall be determined by the Court.

The Court will hold a Final Approval Hearing at 2.00 p.m. PT on Thursday, February 18, 2027, at the Department CX105 of Superior Court for the State of California for the County of Orange., as ordered by the Court. At this hearing, the Court will consider whether the settlement is fair, reasonable, and adequate. If there are timely and valid objections, the Court will consider them and will listen to people who have asked to speak at the hearing if such a request has been properly made. The Court will also rule on the request for Attorneys’ Fees and Expenses Award, as well as the request for Service Award for the Class Representatives. After the hearing, the Court will decide whether to approve the settlement. We do not know how long these decisions will take. The hearing may be moved to a different date or time without additional notice, so Class Counsel recommends checking this Settlement Website, or calling (833) 876-1553.

No. Class Counsel will present the Settlement Agreement to the Court. You or your own lawyer are welcome to attend at your expense, but you are not required to do so. If you send an objection, you do not have to visit the Court to talk about it. As long as you emailed or mailed your written objection on time to the Settlement Administrator according to the instructions provided in Question 15, the Court will consider it.

You may ask the Court for permission to speak at the Final Approval Hearing. 

If you do nothing, you will not receive any payment from this settlement. If the settlement is granted final approval and the judgment becomes final, you will not be able to start a lawsuit, continue with a lawsuit, or be part of any other lawsuit against Defendant or the other Released Persons based on any of the Released Claims.

This Settlement Website summarizes the settlement. More details are in the Settlement Agreement itself.  A copy of the Settlement Agreement is available on the Important Documents. You may also call or email the Settlement Administrator with questions or to receive a Claim Form at (833) 876-1553 or [email protected].

It is your responsibility to inform the Settlement Administrator of your updated information. You may do so at the address below or by using the “Contact Us” button in the upper right corner of this Settlement Website:
 

Kimco Data Incident Litigation
c/o Kroll Settlement Administration LLC
P.O. Box 225391
New York, NY 10150-5391
 

PLEASE DO NOT CONTACT THE COURT, CLERK OF THE COURT OR CLASS COUNSEL FOR INFORMATION ABOUT THE CLASS ACTION SETTLEMENT