Carter Credit Union Data Breach Settlement: $50 With No Proof or Up to $2,500 With Receipts for About 105,185 People — Opt-Out Deadline October 20, Claim Deadline November 19, 2026

If Carter Credit Union — Carter Federal Credit Union, the Springhill, Louisiana credit union — told you in 2025 that your information was involved in its data incident, you can now claim money. The proposed settlement in Ellis, et al. v. Carter Credit Union d/b/a Carter Federal Credit Union offers every class member a choice of one cash option: a flat $50 with no proof at all, or reimbursement of documented out-of-pocket losses of up to $2,500. On top of either, everyone can sign up for three years of CyEx Financial Shield Complete credit monitoring with $1 million of fraud insurance.

The deadlines, as of October 13, 2026, from the official site run by the administrator Simpluris: the deadline to opt out or object is October 20, 2026; the claim deadline is November 19, 2026 (online, or postmarked by that date if you mail it); the final approval hearing is November 30, 2026 at 9:30 a.m. Central Time in Shreveport. The official notice is blunt about the alternative: “If you do nothing, you will not receive a benefit from this Settlement.” You would still give up your right to sue Carter over the incident.

Nobody gets paid before the court approves the deal. The notice says “Settlement payments will be distributed if the Court grants final approval, and after any appeals are resolved.”

According to the settlement agreement, an outside party carried out a “cyberattack perpetrated against Carter’s network from June 25, 2025 through July 2, 2025.” The notice lists what the accessed files may have held: “names; addresses; Social Security Numbers; driver’s license and government-issued ID numbers; financial information (e.g. account numbers, credit or debit card numbers); medical information; health insurance information; dates of birth.” The security news site Teiss, reporting on September 1, 2025 from Carter’s filing with the Maine Attorney General, said Carter detected suspicious activity on July 2 and that the data also included passport numbers and retirement/401(k) benefits information.

How many people are affected depends on which document you read. The Maine filing, as reported by Teiss, said Carter had identified “at least 68,934 individuals.” The settlement agreement signed on May 6, 2026 says: “It is estimated that the Class is comprised of approximately 105,185 individuals” — about half again as many. Neither document explains the gap; the settlement class is the number that counts for the claims process. The class is defined as “All persons whose PII was compromised because of the Data Incident experienced by Defendant beginning on or about June 25, 2025.” Carter denies wrongdoing, and the court has not decided who is right; the claims of negligence, breach of implied contract and unjust enrichment are allegations.

The case took a detour. The first suit was filed on September 4, 2025 in federal court in the Western District of Louisiana, related cases were consolidated on October 28, 2025, and a consolidated complaint followed on November 25, 2025. After a mediation, the parties decided state court was the right forum, dismissed the federal case and refiled in the 1st Judicial District Court in Caddo Parish on March 25, 2026.

Documented losses, up to $2,500. The losses must have happened between June 25, 2025 and November 19, 2026 and be “fairly traceable to the Data Incident.” The notice names identity-theft and fraud losses, fees for credit reports, credit monitoring or credit freezes, the cost of replacing IDs, and postage to contact banks. You need proof such as bank statements or receipts; your own notes can support other proof but are not enough on their own, and costs already reimbursed by someone else do not count. One useful safety net in the agreement: if a documented claim is rejected and not fixed, “the Claim will be rejected and the Settlement Class Member’s Claim will be as if he or she elected the Alternative Cash Payment” — you fall back to the $50.

Flat $50. No proof or explanation. You cannot combine it with the documented-loss payment. A draft notice attached to the agreement called this a pro rata payment “expected to be $50.00”; the final notice on the official site states a one-time cash payment of $50.00, and the official site wins.

No shared pot. The agreement says the settlement “shall be administered on a wholly claims-made basis” — Carter pays each approved claim rather than splitting a fixed fund, and the agreement sets no overall ceiling. Lawyers’ fees of up to $400,000, service awards of $2,000 for each of the nine class representatives and the cost of administration are all paid by Carter separately, so they do not reduce your payment.

Timing. The agreement gives the administrator 21 days after the claim deadline to process claims, then a review round for the lawyers; payments go out within 45 days of the “Claims Finalization Date.” Approval only becomes final 30 days after the court’s order if no one appeals. No payment date has been announced. Credit-monitoring activation codes arrive by email within 10 days of the Claims Finalization Date and stay active for 90 days. The claim form attached to the agreement offers PayPal, Venmo, Zelle, a virtual prepaid card or a paper check. Cash it promptly: payments not cashed within 90 days “will become null and void and will revert to Carter or its insurer.”

To get paid: file at CCUDataSettlement.com by November 19, 2026, or download the paper form and mail it, postmarked by that date, to Carter Credit Union Data Incident Settlement, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799-9958. You can also ask for a paper form at 1-(866) 675-2433 (toll-free, 24/7) or info@CCUDataSettlement.com. If you are not sure whether you are in the class, the same contacts will check for free.

To opt out: mail a signed Request for Exclusion with the case name, your full name, mailing address, phone number and email, postmarked by October 20, 2026, to the same P.O. box, attention Exclusion Request. Opting out means no money, but you keep the right to sue Carter yourself.

To object: stay in the class and file a written objection with the Clerk of Court, 501 Texas St, Shreveport, LA 71101, by October 20, 2026, and send a copy to the administrator, attention Objections. The notice lists six required items, including your reasons, any objections you or your lawyer filed in other cases in the past four years, whether you want to speak at the hearing, and your own signature. You can object and still file a claim. The agreement required class counsel — Ellzey Kherkher Sanford Montgomery, Milberg and the Murphy Law Firm — to file their fee request at least 14 days before the objection deadline.

The postcards and emails went out on August 21, 2026, according to the official site’s dates page. The genuine settlement uses one website, CCUDataSettlement.com, one administrator, Simpluris, one phone number, 1-(866) 675-2433, and one mailing address, P.O. Box 25226 in Santa Ana, California. The real notice says “A court has authorized this notice. This is not a solicitation from a lawyer.” Ads from law firms saying they are “investigating” the Carter breach are not the settlement and are not needed to file a claim. The notice also tells class members: “DO NOT CONTACT THE COURT OR CLERK OF COURT REGARDING THIS SETTLEMENT.”

Two timing facts help spot fakes. Money cannot arrive before final approval, and the hearing is November 30, 2026, so any message before then claiming a payment is waiting is not from this settlement. Credit-monitoring activation codes are only emailed after claims are finalized, so an unexpected code before that point deserves suspicion. When in doubt, type the address yourself rather than clicking a link.

This settlement is about stolen personal information, not about the safety of deposits, and nothing in the settlement documents says member deposits were lost. Deposit safety is a separate system: according to the National Credit Union Administration, “The Share Insurance Fund insures individual accounts at federally insured credit union up to $250,000,” and “No one has lost a single penny of insured deposits at a federally insured credit union.” Federally insured credit unions must display the official NCUA sign in branches and on their website; Carter’s website footer reads “Federally Insured by NCUA.”

Share insurance does not pay for identity theft after a breach. For that, this settlement’s documented-loss payment and the three years of credit monitoring are the remedy; for a fraudulent transaction on your account, contact Carter directly. Carter has also agreed in the settlement to “keep in place reasonable enhanced security safeguards.”

Carter was chartered in 1954 to serve employees of International Paper Company in Springhill and says it now serves 13 locations. The deal follows the pattern of many recent data breach settlements with no fixed fund: a flat no-proof amount, a documented-loss cap, and credit monitoring, with fees paid on top. The $50 flat payment is a fixed amount rather than an estimate, which makes it more predictable than pro rata settlements where many claims shrink the check. The uncashed-check rule cuts the other way: in many pooled funds leftover money goes to a charity or a second round, here it goes back to Carter or its insurer. As of October 13, 2026 the administrator has not published how many claims have been filed.