EFS Advisors & Aviben Data Breach Class Action Settlement

Data Breach · Claims Open

Current Status

Claims are open. The deadline to submit a Claim Form is October 22, 2026, online or postmarked. The deadline to exclude yourself or to object is earlier — October 7, 2026 — so the first decision to make is whether to stay in at all. The court has not yet decided whether to approve the settlement: the Isanti County District Court granted preliminary approval and authorized this notice, and the final approval hearing is set for November 6, 2026 at 9:00 a.m. Central, by Zoom. No payments have been issued and no payment date has been announced; the Notice says benefits are issued only after the settlement is approved and becomes final, and appeals can extend that. If you received a notice with a Notice ID and Confirmation Code, the action to take now is to file before October 22.

What Changed Recently?

The claim window opened after the Isanti County District Court entered an order granting preliminary approval of the class action settlement, which authorized the notice now reaching class members and put the November 6, 2026 final approval hearing on the calendar. That order is posted alongside the Notice, Claim Form and Settlement Agreement on the settlement website's Important Documents page.

The case is Kennedy, et al. v. EFS Advisors, LLC, et al., Case No. 30-cv-24-649, in the Isanti County (Minnesota) District Court. The defendants are EFS Advisors, LLC and Educators Benefit Consultants, LLC, which does business as Aviben. The Notice describes the underlying event as an unauthorized third-party attempt to access the defendants' computer network, detected on or about February 22, 2024, during which the unauthorized actor may have accessed impacted individuals' Private Information.

Worth knowing before you read further: the Notice is unusually sparse about the incident itself. It does not list the categories of data involved and does not state how many people are in the class. For the data categories it points to the Settlement Agreement's definition of Private Information and to the Consolidated Class Action Complaint, both posted on the settlement website. For your own situation, the breach notification letter you received in 2024 is the document that names the specific elements.

The parties disagree over the legal claims. The Notice states that the action has not gone to trial and that the court has not decided in favor of either side; the parties agreed to settle after weighing the risks and uncertainties of continuing to litigate. Nothing in the settlement is a determination that either defendant did anything wrong.

Who Qualifies?

The Settlement Class is defined broadly: all living individuals in the United States whose Private Information was potentially accessed in the Data Security Incident. There is no purchase requirement, no state limitation, and no requirement that you suffered fraud or identity theft.

Three groups are carved out. Excluded from the class are the directors, officers and agents of the defendant; governmental entities; and the judge assigned to the action, that judge's immediate family, and court staff.

Because the class is defined by whose information was in the affected systems rather than by anything you did, the practical test is whether the administrator sent you a notice with a Notice ID and Confirmation Code. Many people in a class like this never had a direct relationship with either company — a benefits administrator typically holds employee information supplied through an employer's plan. If you are unsure whether you are included, the settlement website's contact page is the route to ask.

How Much Can You Get?

Everyone who submits a timely, valid Claim Form may claim two things: one year of three-bureau credit monitoring that includes at least $1,000,000 in identity theft insurance, and one of two cash options. The credit monitoring is not an either-or against the cash — the choice is only between the two cash options.