The RPM data settlement marks a significant resolution to a high-profile class action lawsuit arising from a data breach incident involving Receivables Performance Management, LLC (“RPM”). This settlement addresses the harm caused when personal information of millions of individuals was exposed due to alleged inadequate cybersecurity measures. The following comprehensive article provides an extensive overview of the RPM data settlement: its background, terms, legal reasoning, impact, claims process, current status, and broader ramifications for consumers and data privacy standards.
Background of the RPM Data Settlement
The genesis of the RPM data settlement stems from a major data breach at RPM, a Washington-based debt collection company, in the spring of 2021. The breach compromised names, Social Security numbers, and other personal information of approximately 3.7 million individuals nationwide. RPM discovered the incident on May 12, 2021, but the notification to affected individuals began much later, in November 2022. The delay and the nature of the disclosure became grounds for considerable criticism and several lawsuits from those impacted by the breach.
- Plaintiffs alleged RPM failed to implement and maintain reasonable security measures to protect personally identifiable information (PII) from cyberattack and unauthorized access.
- The lawsuits claimed RPM’s conduct contradicted privacy policy promises and violated federal and state guidelines regarding data protection.
- RPM denied all allegations but agreed to a settlement to avoid uncertainty, expense, and risks of extended litigation and trial.
- On August 2, 2024, the court granted preliminary approval for the RPM data breach settlement, opening the door for affected individuals to seek compensation.
This case stands as a high-profile example of mass harm resulting from poor cybersecurity in consumer-facing organizations.
Details of the RPM Data Settlement Terms and Eligibility
The RPM data settlement establishes a $5.6 million settlement fund to compensate class members whose information was potentially compromised. Key terms and eligibility requirements include:
- Settlement Class: The class includes all individuals who received a notification letter from RPM alerting them that their PII may have been affected.
- California Subclass: A separate subclass covers California residents entitled to additional statutory damages under state law.
- Out-of-Pocket Losses: Eligible class members who incurred financial costs due to the data breach can be reimbursed for documented losses.
- Compensation for Lost Time: Members may claim up to 4 hours at $25 per hour for time spent responding to the incident (filing reports, freezing accounts, etc.).
- Credit Monitoring and Identity Protection: Class members are also eligible for up to three years of monitoring and protection services.
- California Statutory Payment: California residents can claim an additional $50 payment under state privacy statutes.
| Settlement Benefit | Description |
|---|---|
| Out-of-Pocket Losses | Documented costs caused by the data breach, reimbursed from the fund |
| Lost Time Compensation | Up to 4 hours at $25/hour for time related to incident response |
| Credit Monitoring | Three years of free services for all class members who submit valid claims |
| California Statutory Damages | Extra $50 for California residents in the subclass |
The only way to receive benefits is to file a timely claim. Those who opt out preserve individual legal rights but forgo settlement benefits.
Legal Framework and Reasoning Behind the RPM Data Settlement
The legal claims central to the RPM data settlement revolve around privacy and cybersecurity obligations. Key points include:
- Negligence and Data Security: Plaintiffs argued RPM failed its duty to protect sensitive data by failing to adopt reasonable technical and organizational measures, which led to the breach.
- Violation of Consumer Protection Laws: Federal and various state statutes require proper safeguarding of personal information and prompt notification of data incidents.
- Privacy Policy Breach: RPM’s actions allegedly contradicted promises made in its privacy policy and fell short of regulatory expectations for data security.
- No Admission of Liability: While RPM denies responsibility for the breach, the settlement allows affected parties to receive compensation and credit monitoring without further litigation.
The court’s preliminary approval reflects the assessment that the settlement is fair, reasonable, and adequate under class action standards. By resolving claims collectively, the settlement avoids the risks and delays of trial while ensuring meaningful relief for class members.
Impact of the RPM Data Settlement on Consumers and Industry
The settlement has significant consequences for consumers, RPM, and the broader data privacy landscape:
- Consumer Redress: The settlement compensates impacted individuals for losses and offers direct support for minimizing future identity theft risks through monitoring services.
- Industry Wake-Up Call: The financial and reputational implications for RPM underscore the importance of robust cybersecurity for any company handling sensitive consumer data.
- Legal Precedent: The action emphasizes that courts and regulators will hold companies accountable for failing to secure personal information.
- Remedial Efforts: RPM now faces ongoing scrutiny regarding improvements to its data protection standards and incident response protocols.
- California Protections: The statutory damages awarded to California residents highlight strengthened privacy rights under the state’s Consumer Privacy Act (CCPA).
The settlement sets a wider standard for consumer protection and the legal risks organizations face for data breaches.
Current Status and Updates on the RPM Data Settlement
As of September 2025, the RPM data settlement is in the claim submission phase. Key current updates include:
- Claims opened after preliminary approval on August 2, 2024; deadline for filing claims is November 12, 2024.
- Class members must use their unique claimant ID provided in RPM’s notification to access and file claims online or via mail.
- Exclusion and objection deadlines mirror the claim deadline, with a final court approval hearing scheduled for December 6, 2024.
- Once approved, the settlement administrator will begin distributing payments and benefits to eligible class members.
- Class counsel and RPM continue to provide information and updates through official settlement websites and support helplines.
Individuals who fail to act before deadlines will forfeit eligibility for benefits and remain bound by the terms of the settlement.
Consumer Guidance and Claims Process for the RPM Data Settlement
To receive compensation or credit monitoring under the RPM data settlement, affected individuals must follow these steps:
- Confirm Eligibility: Verify receipt of RPM’s breach notification and ensure claimant status within the settlement period.
- Gather Documentation: Prepare records of out-of-pocket expenses or time spent responding to the breach for payment claims.
- Complete and Submit Claim Form: Submit claims using the unique ID online or by mail before the November 12, 2024 deadline.
- Select Desired Benefits: Indicate claim for lost time, financial losses, and credit monitoring, and statutory damages for California residents.
- Monitor Communications: Respond promptly to any settlement administrator requests for additional documentation or clarification.
- Opt-Out or Object (Optional): Class members may choose to exclude themselves or object to the settlement by sending required forms before deadlines.
It is vital to act promptly and adhere to all instructions to secure available compensation or protection services.
Conclusion: Significance and Future Outlook of the RPM Data Settlement
The RPM data settlement exemplifies the modern legal and regulatory response to large-scale data breach incidents. Through its $5.6 million fund and comprehensive benefits, it provides immediate relief for impacted consumers while setting a consequential precedent for corporate accountability and data privacy standards nationwide.
This case serves as a powerful reminder for companies to adopt best practices in cybersecurity and incident response. For consumers, it highlights the importance of participation in legal remedies and vigilance in the face of evolving digital threats. For the broader industry, it signals that negligent data management will likely result in costly and high-profile settlements.
As final approval approaches and payments begin, the RPM data settlement will remain a touchstone in the advancement of U.S. data protection enforcement and the rights of consumers harmed by data compromise. Future incidents and actions will build upon its lessons, driving stronger safeguards and quicker, fairer compensation for digital harms.
