Dairy Farmers of America (DFA) Data Breach Class Action Settlement

Data Breach · Claims Open

Current Status

Claims are open. The deadline to submit a Claim Form is October 14, 2026, whether you file online, send it by email, or mail it — a mailed form must carry a postmark no later than that date. The Notice does not specify a cutoff time, so only the date is published here. The deadline to exclude yourself or to object is a month earlier, on September 14, 2026. The District Court of Wyandotte County, Kansas authorized the notice program, and the Final Approval Hearing is set for October 26, 2026 at 10:00 a.m. Central Time. No final approval order has been entered and no payment date has been announced.

What Changed Recently?

The claim window is open and the notice program has run. The case is Jason Buhl v. Dairy Farmers of America, Inc., Case No. WY-2026-CV-000143, in the District Court of Wyandotte County, Kansas, with Simpluris administering. Notices carrying each class member's LoginID and PIN have gone out to the class list, and the online claim portal is live.

The incident behind the case dates to June 2025. The Notice describes it as a data security incident at DFA in June 2025 in which certain files containing private information may have been accessed by an unauthorized third party, and says those files may have held personal information — information identifying an individual, or information that in combination with other data could be used to identify, locate, or contact one. The settlement documents do not go further than that.

Public reporting on DFA's breach notices fills in the specifics the settlement papers leave out. According to that reporting, the unauthorized access began on June 11, 2025 and was discovered two days later, the intruder got in through what DFA described as a sophisticated social engineering campaign, and the breach notice DFA filed with the Maine Attorney General's office reported 4,546 people affected. The data types listed there were names, Social Security numbers, driver's license or state ID numbers, dates of birth, bank account numbers, and Medicare or Medicaid numbers. DFA began mailing notification letters on October 14, 2025. The Play ransomware group claimed credit for the attack on its leak site — that is the group's own claim, not something DFA or the Court has confirmed.

DFA denies that it did anything wrong, and the Notice states plainly that the Court has not decided who is right. Both sides agreed to settle to avoid the costs, risks, disruptions and uncertainties of continuing the litigation.

Who Qualifies?

The Court defined the Class as all individuals residing in the United States whose Personal Information was compromised in the Data Incident, including all those individuals who received notice of the Data Incident. That is the whole test — no state residency requirement beyond living in the United States, no requirement that you still work for DFA or still be a member of the cooperative. The Notice adds that DFA's records indicate class members are entitled to benefits, and that some people may have received an earlier notice directly from DFA, which lines up with the October 2025 mailing.

Excluded from the Class are the judge assigned to the case along with that judge's family and staff; DFA and its officers, directors and related companies; and anyone who validly excludes themselves from the settlement.

A practical note on who can actually file: the online portal is gated on a LoginID and PIN printed on the mailed notice. So while the class definition is written broadly enough to reach people beyond the notified list, in practice the people who can complete a claim are the people DFA identified and wrote to.

How Much Can You Get?

There are three benefits, and the structure here is worth reading carefully because it is the opposite of what a lot of recent breach settlements do: nothing is automatic.