Never Heard of Doxim? That's Exactly Why the Settlement Letter Looks Fake. The $5.5 Million Is Real, the $100 Is the Administrator's Own Estimate — and the Cash Is Funded Last

The mailing fails the usual smell test through no fault of its own. It offers money from a company you never gave your data to, over a breach you probably never heard about, and it arrived unprompted. But that is precisely what a vendor-breach settlement looks like. Doxim, Inc. processes statements and customer communications for credit unions. Around December 30, 2023, per the court-authorized settlement site, “an unauthorized actor gained access to Doxim's files” — and with them, data the company held on its clients' members: “names, addresses, financial account numbers, and Social Security numbers.”

That client relationship is also why the defendants are not just Doxim: the case names Credit Union ONE and Beacon Credit Union alongside it. You are covered if you are a U.S. resident who was “identified by Doxim and sent a notice by Doxim or Doxim's Credit Union Clients” that your information was involved — which is exactly what the letter in your hand is. Postcard notices began mailing in late July 2026, which is why the question is spiking now, roughly two and a half months before the deadline.

Every fact on the mailing can be checked against public records. The case is In re Doxim, Inc. Data Security Incident Litigation, Case No. 2:24-cv-11550, before Judge Terrence G. Berg in the U.S. District Court for the Eastern District of Michigan, Southern Division. The court-authorized website is DoximDataSecuritySettlement.com; the administrator answers at 1-877-318-7817 and receives mail at P.O. Box 2509, Portland, OR 97208-2509. Class counsel — appointed by the court, named in the FAQ — are Jeff Ostrow (Kopelowitz Ostrow), E. Powell Miller (Miller Law), Bryan L. Bleichner (Chestnut Cambronne) and Mariya Weekes (Milberg).

The structural tells all point the right way, too. A legitimate settlement never asks you to pay anything to claim. Opting out works only by postal mail — the FAQ states you “cannot opt out (exclude yourself) by telephone or by email,” so anyone calling to “help you opt out” is not the administrator. And the notice itself carries the court's standing instruction: “PLEASE DO NOT TELEPHONE THE COURT OR THE COURT'S CLERK OFFICE REGARDING THIS NOTICE.” If a caller claims to be the court, that alone settles it.

The claim form offers two cash routes plus one add-on, all from the official FAQ. Cash Payment A reimburses documented fraud or identity-theft losses “that can be reasonably traced to the Data Incident” up to $5,000 per person — phone records, correspondence and receipts count as documentation. Cash Payment B requires no documentation at all: a payment “in the estimated amount of $100.” Note whose estimate that is — unlike most settlements, where the round number comes from press coverage, the $100 here is the administrator's own published figure. It remains an estimate: the FAQ says it rises or falls pro rata, “on an equal percentage basis,” depending on claim volume.

On top of either payment — not instead of — you may also claim one year of credit monitoring. And here sits the detail that decides what Cash B is worth: the FAQ instructs that the administrator “must first distribute the funds in the Net Settlement Fund for payment of Credit Monitoring and then for Cash Payments.” Monitoring is funded first; cash absorbs the squeeze. Heavy monitoring uptake shrinks the pool the $100 comes from — worth knowing when you decide which boxes to tick.

Two smaller rules reward the careful: if your documentation for Cash A falls short and you don't cure it, the claim is automatically processed as Cash B — you don't lose the $100 by aiming high. And leftover money doesn't return to Doxim: residual funds go to a cy pres recipient, proposed as the Michigan State Bar Foundation.

Three dates govern. Claims are due October 13, 2026 — online by 11:59 p.m. Eastern or postmarked. Opt-outs and objections are both due September 28, 2026, opt-outs by mail only. The Final Approval Hearing is October 28, 2026 at 10:00 a.m. before Judge Berg at the Theodore Levin U.S. Courthouse in Detroit — with the FAQ's standard caveat that the date can move and the hearing may go remote.

Fees follow the familiar pattern: class counsel will ask for up to one-third of the settlement fund plus costs, and service awards of up to $2,500 per class representative. On a $5.5 million fund, a full one-third award is about $1.83 million — that fraction is our arithmetic, the one-third request is the FAQ's. Payment reaches claimants only “after the Settlement is approved by the Court and becomes final,” which puts realistic checks in 2027 if there are no appeals.

One logistical footnote from the FAQ that scam-checkers should read as reassurance: if you move after filing, the administrator asks you to update your address by postal mail to the Portland P.O. box. An operation this analog is many things, but it is not phishing. Full case history and running status: our Doxim tracker.