Educational Computer Systems - Data Breach Class Action Settlement

Data Breach · Claims Open

Current Status

Claims are open. Claim forms must be submitted online or postmarked by December 21, 2026. The court authorized notice to the class, and a telephonic final approval hearing is scheduled for January 11, 2027, at 9:30 a.m. Eastern. The settlement has not received final approval, and no payment date has been announced as of October 2, 2026. Class members who want money have to file a claim.

What Changed Recently?

Educational Computer Systems, Inc. agreed to a $6.5 million settlement of Hood, et al. v. Educational Computer Systems, Inc., a consolidated class action in the U.S. District Court for the Western District of Pennsylvania. The court authorized notice to class members, and the claim process is now open on the official settlement website.

ECSI, based in Coraopolis, Pennsylvania, provides student loan servicing, tuition payment plans and tax document services for colleges and universities. According to the notice, cybercriminals attacked ECSI’s website between October 29, 2023 and February 12, 2024, potentially exposing personal information. The consolidated complaint alleges that the attackers used a guest tax-form lookup on the website to pull students’ and borrowers’ Form 1098-E and 1098-T tax documents, which include names, addresses and Social Security or taxpayer identification numbers, and that ECSI did not notice for about four months. The lawsuit claims ECSI’s data security was inadequate. ECSI denies the allegations and any liability, and the court has not ruled for either side.

Who Qualifies?

The settlement class includes all persons residing in the United States whose personal information was potentially accessed in the ECSI security incident between October 29, 2023 and February 12, 2024. People who received a settlement notice are on the class list.

The presiding judge and the judge’s staff and immediate family, anyone convicted of or pleading no contest to involvement in the attack, and anyone who opts out are excluded.

How Much Can You Get?

Each class member chooses one of two benefits.

• Out-of-pocket losses: reimbursement of up to $5,000 for documented, unreimbursed losses more likely than not caused by the incident between October 29, 2023 and December 21, 2026. Eligible losses include fraud losses, bank fees, per-minute phone and usage-based data charges, postage, local travel gas, and credit reports, credit monitoring or identity theft protection bought during that period.
• Alternative cash payment: a pro rata payment estimated at about $100, with no documentation required.

The two cannot be combined. The $6.5 million fund also pays attorneys’ fees and costs (class counsel may seek up to one-third, or $2,166,666.66), service awards of $2,500 for each class representative, and administration costs. The cash payment is calculated at the end of the process and rises or falls with the number of approved claims, so the $100 figure is an estimate rather than a fixed amount. OCA’s explainer on pro rata distribution covers how that adjustment works.

What Proof or Notice ID Is Required?

The online claim form opens with a login screen that asks for the Notice ID and Confirmation Code printed on the class member’s notice. Without those codes, the online form cannot be completed.

The printable claim form posted on the official settlement website does not ask for a Notice ID. It asks only for name, contact information, the benefit chosen, a payment method and a signature. A class member who no longer has the notice can complete that form and mail it to the settlement administrator, postmarked by the deadline.

The $100 cash option needs no documentation. A claim for out-of-pocket losses must include records showing the amount lost and why it was more likely than not caused by the incident, such as card or bank statements, invoices, receipts, emails or phone records. Self-prepared documents like handwritten receipts are not enough on their own.