Central One Data Breach Lawsuit: 56,923 Members Exposed, Case Dismissed
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Central One Federal Credit Union, based in Shrewsbury, Massachusetts, says an outsider was inside its network from August 26 to August 30, 2025 and copied files. Social Security numbers, ID numbers, account and card numbers and health-insurance details were involved. One federal class action followed in November 2025. It was voluntarily dismissed on May 19, 2026. There is no settlement, no fund and no claim form.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened, and What the Lawsuit Said
Central One is a federally chartered credit union headquartered at 714 Main Street in Shrewsbury and describes itself as one of Central Massachusetts’ largest federal credit unions. According to its own notice, quoted in the complaint, an unauthorized party had access to certain Central One systems between August 26, 2025 and August 30, 2025 and “acquired copies of some files.” The credit union identified the suspicious activity on or about August 30, 2025.
Around November 10, 2025 it reported the incident to state agencies, including the Massachusetts Office of Consumer Affairs and Business Regulation, listing 56,923 Massachusetts residents. The Texas Attorney General’s breach list published a notice on November 12, 2025.
The lawsuit alleged that Central One kept member data in an unencrypted, internet-accessible environment and waited until November 2025 to notify people. It cited the HIPAA rule that health-data breaches be reported within 60 days of discovery. It pleaded negligence, negligence per se, breach of implied contract, unjust enrichment and declaratory judgment. None of this was proven; Central One never had to answer the claims on the merits.
Case Details
Petralias v. Central One Federal Credit Union, No. 1:25-cv-13518, U.S. District Court for the District of Massachusetts, filed November 21, 2025. It was assigned to District Judge F. Dennis Saylor IV, with Magistrate Judge Donald L. Cabell for referred matters. The docket shows a returned summons on December 31, 2025, notices of appearance and an extension of time on January 15, 2026, a stay on February 17, 2026 and a notice of voluntary dismissal on May 19, 2026. We found no other lawsuit over this breach, in federal or state court.
Status: Dismissed by the Plaintiff, No Settlement
What matters for members: no class was ever certified, so the dismissal did not decide anyone else’s rights — and it also produced no settlement, no fund, no administrator, no claim form and no deadline. If a new Central One data breach suit or a settlement appears, class members would be notified by a court-appointed administrator.
Who Was Affected
The proposed class was “all individuals in the United States whose Private Information was compromised in the Data Breach.” Per the complaint, that included current and former members and certain of their family members. The only official count we could confirm is the Massachusetts figure: 56,923 residents.
The practical test is your mail. Central One sent notice letters in November 2025. Keep yours: it lists which fields were in your record. Since the case is dismissed, there is nothing to join and nothing to sign up for.
Is There Any Money?
For context only: other credit-union and bank breach cases that did settle usually paid documented out-of-pocket losses plus a small flat amount. Our data breach settlement calculator shows how those funds split. It is not a prediction for Central One. The Central Maine Healthcare data breach settlement is a different company and a different case.
How cases like this one end
Our copy of the federal courts’ own case database covers 83,315 other statutory actions casesclosed in U.S. federal district courts between 2015 and 2026, 11.8% of them filed as class actions:
- 25.6% ended in a settlement recorded by the court. Another 22.4% were dismissed voluntarily, which often follows a private settlement — so the real settlement share sits between 25.6% and 47.9%.
- 7.4% were decided on a motion before any trial.
- 1 in 156 reached a trial (0.6%), after a median of 21.8 months.
- Median time from filing to the end of the case: 4.9 months.
- Only 1,756 of them (2.1%) record a money award at all; the median of those is $199,500.
These are base rates for this type of case (federal other statutory actions cases) — not a prediction about this lawsuit, and not legal advice. Source: Federal Judicial Center, Integrated Database (civil), analysed by Settlement Insight. Cases heard in state courts are not included.
Central One Breach Timeline
- 1
August 26–30, 2025 — The Intrusion
Per Central One’s notice, an unauthorized party had access to certain systems and copied some files. The activity was identified on or about August 30.
- 2
November 10–12, 2025 — Regulators Notified
Central One reports 56,923 affected Massachusetts residents to the state; the Texas Attorney General posts a notice on November 12. Member letters go out in November.
- 3
November 21, 2025 — Class Action Filed
Petralias v. Central One Federal Credit Union, No. 1:25-cv-13518, is filed in federal court in Massachusetts and assigned to Judge F. Dennis Saylor IV.
- 4
February 17, 2026 — Case Stayed
After service and an extension of time, the court docket records a stay. No answer or motion to dismiss on the merits appears.
- 5
May 19, 2026 — Voluntary Dismissal
The plaintiff files a notice of voluntary dismissal. No class was certified and no settlement was announced.
- 6
October 2026 — Nothing Pending
As of October 11, 2026, we found no other lawsuit, no settlement, no claim form and no deadline tied to the Central One breach.
Three Things to Watch For
The files that were copied may have held account and card numbers next to Social Security numbers. That makes credit-union impersonation the main risk:
Calls or texts “from Central One fraud”
A caller who knows your name and account number can sound genuine. Hang up and call the number on the back of your card. Your credit union will not ask you to read back a one-time code or move money to a “safe account.”
“Claim your Central One settlement”
There is no settlement and the only lawsuit is dismissed. A page or message asking for your Social Security number or a fee to “release your payment” is collecting data, not paying claims.
Fake health-insurance contacts
Health-insurance details were in the breach too. Read your insurer’s explanation-of-benefits statements for care you never received, and do not confirm member IDs to anyone who calls you first.
Central One Data Breach — Questions People Actually Ask
Is there a Central One data breach lawsuit?
There was one: Petralias v. Central One Federal Credit Union, No. 1:25-cv-13518, filed November 21, 2025 in the U.S. District Court for the District of Massachusetts. The plaintiff voluntarily dismissed it on May 19, 2026. As of October 11, 2026 we found no other case.
How many people were affected by the Central One data breach?
Central One reported 56,923 Massachusetts residents to the Massachusetts Office of Consumer Affairs and Business Regulation around November 10, 2025. We could not confirm a total that includes people in other states.
What information was exposed?
Per the complaint and the Texas Attorney General notice: names, Social Security numbers, driver’s license and other government ID numbers (such as passport or state ID), financial information such as account and card numbers, and medical and health-insurance information. Your letter says which applied to you.
Is there a Central One data breach lawsuit payout?
No. The lawsuit was dismissed before any class was certified, so there is no settlement, no fund, no claim form and no deadline. Nothing is owed to members from that case.
Are data breach settlements legit?
Real ones are run by a court-appointed administrator, have a case name and number you can check on the court docket, and never charge a fee to file. For Central One, that check is easy: the only case was dismissed, so any “Central One settlement” message is not genuine. Real open settlements are listed on our open settlements page.
Is this the Capital One data breach?
No. Capital One is a separate, much larger bank, and its data breach was handled in an entirely separate lawsuit. Central One is a Massachusetts credit union. For the Capital One case, see our Capital One settlement calculator.
I saw other “Central” cases in the news. Are they related?
No. The NYC Central Booking settlement (see also its claim-form details) is about detention delays, and the Saks quiet-hours lawsuit is about texts. Neither involves Central One.
What is worth doing right now?
Freeze your credit at all three bureaus — free and reversible. If your card or account number was listed in your letter, ask Central One about a replacement. Keep the letter: if a new case or settlement ever appears, it is your proof you were affected.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Open Class Action Settlements
Settlements taking claims right now, with deadlines
Data Breach Settlement Calculator
What comparable breach settlements have paid per person
Capital One Settlement Calculator
A different bank and a different case, often confused with this one
Class Action Payout Calculator
Estimate a per-person share from fund size and claim rates