American Consumer Credit Counseling Will Pay $45 With No Proof — or Up to $3,500 With Receipts — After Social Security Numbers Left Through Its Email in January 2025, and the Notice Offers No Way to Opt Out

The settlement website lays out the money as a choice. Category 1 is for people who can document what the breach cost them: “actual, documented out-of-pocket losses traceable to the Data Incident … not to exceed $3,500.00,” for losses between January 27, 2025 and September 16, 2026 — identity-theft losses, credit-report and credit-freeze fees, the cost of replacing IDs, postage. Proof means bank statements or receipts; the site says your own notes “alone are not enough to make a valid claim.” Category 1 claimants can add lost time at $20 an hour, up to four hours, for a maximum of $80, with a brief description of what the time went to.

Category 2 is the alternative: “a one-time cash payment for $45.00. You do not have to provide any proof or explanation to claim this payment.”

Both categories come with the same third benefit, and it is not either-or: three years of CyEx Financial Shield Complete, which the site describes as carrying $1 million of financial fraud insurance and monitoring for identity theft, unauthorized transactions and high-risk financial activity. That part is available to every class member who files.

The catch is the one that applies to every claims-made settlement: “The only way to receive benefits or payments from this Settlement is by submitting a valid and timely Claim Form.” Doing nothing gets you nothing and still releases your claims.

American Consumer Credit Counseling is a 501(c)(3) nonprofit credit counseling and debt management agency based in Auburndale, Massachusetts — the kind of organization people hand their full financial picture to on purpose. The settlement site describes the incident narrowly: in January 2025, “a criminal third party gained unauthorized access to certain of Defendant's employee email accounts.” The files in those accounts “may have contained personal information such as: name, Social Security number, driver's license number, financial account number, and/or payment card information.”

Note the shape of that. This was not a breach of a client database; it was mailboxes. What an intruder gets from a mailbox depends entirely on what staff had attached to or pasted into email, which is why the notice says “may have” rather than “did.” The class is defined by exposure, not by confirmed theft: “All individuals residing in the United States whose PII was potentially compromised in the Data Incident … including all those who received notice.”

The case is Dinkel, et al. v. American Consumer Credit Counseling, Inc., Case No. 2581CV02933, in the Superior Court of Middlesex County, Massachusetts — a state court, not federal. The class representatives are Veronica Hicks and Justin Dinkel. ACCC “denies that it did anything wrong, and denies all claims, allegations, and liability,” and the court has made no finding that it did.

The site's Important Dates list has four entries, and three of them are already behind you or out of your hands.

Notification mailing: June 18, 2026. If you are in the class, a notice went out ten weeks ago. Objection deadline: August 17, 2026 — passed. The window to tell the court you think the deal is unfair closed twelve days ago. Claim deadline: Wednesday, September 16, 2026 — a claim form “submitted, emailed, or postmarked” by that date. From today, that is eighteen days. Final approval hearing: Thursday, October 8, 2026 at 2:00 p.m. Eastern.

Filing online is the fast route. Paper forms go to ACCC Data Incident Settlement, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799; the administrator is Simpluris, reachable 24/7 at (833) 421-7260 or info@ACCCSettlement.com. Documented-loss claims have to include the supporting paperwork with the form.

On timing of payment, the FAQ is honest and vague in the way these things are: benefits go out “if the Court grants final approval, and after any appeals are resolved. We do not know if appeals will be filed, or how long it will take to resolve them.”

Most class settlement notices give four choices: file, object, do nothing, or opt out. This one gives three. The court-approved notice and the site's summary table list Submit a Claim, Object to the Settlement and/or attend a hearing, and Do nothing. There is no exclusion request, no opt-out deadline and no address to send one to. We searched the nine-page long-form notice for any exclusion or opt-out language; the only “excluded” language in it is the standard list of who is not in the class (the company, its officers, the judge, anyone convicted of causing the breach).

The practical meaning is stated on the site: “You are automatically part of the Settlement. If you do nothing, you will not receive benefits or payments from this Settlement and you will give up the right to sue.” If you were hoping to keep an individual claim against ACCC alive, the vehicle for that is not on this notice, and the objection deadline that might have been used to raise it passed on August 17. Whether that structure survives the October 8 hearing is for the court; class members should plan on the release being final.

There is no headline settlement fund here. The site never states a total, because the deal is claims-made: ACCC pays whatever valid claims add up to, within the caps, plus the monitoring. That means the $45 is a real $45, not a share of a pool that shrinks with every additional claimant — unlike most data-breach settlements, where the no-proof payment is an estimate that gets cut pro rata when too many people file.

The lawyers' money is also kept apart. According to the long-form notice, class counsel will ask the court to approve $225,000.00 in attorneys' fees and costs, and “if approved, these fees and costs will be paid by Defendant.” Service awards of $4,000 for each class representative, not to exceed $8,000, are likewise paid by ACCC. None of it reduces what a claimant gets.

Set against the exposure — Social Security numbers and account numbers, the two data types that do not expire — $45 is small, and the site does not pretend otherwise. Its own framing is that the monitoring is the substantive benefit and the cash is the alternative. Anyone who actually lost money to fraud after January 2025 and has the statements to show it should be looking at Category 1 and the $3,500 cap, not the $45.