The $6.5 Million Educational Computer Systems Breach Settlement Covers 2,577,994 People and Estimates About $100 Each — but After Fees the Fund Pays That Much to Roughly 43,000 Claimants at Most. Claim Deadline: December 21, 2026.

If you got an email or postcard about the Educational Computer Systems breach, it is about a real, court-supervised settlement. ECSI — the company many colleges use for student loan billing and tax forms — set up a $6,500,000 fund in Hood v. Educational Computer Systems, and Judge Christy Criswell Wiegand of the Western District of Pennsylvania gave it preliminary approval on August 5, 2026. You must file a claim to get anything: the notice says plainly that if you do nothing, “you will not receive any money from the Settlement and you will not be able to sue ECSI.”

You choose one of two payments: reimbursement of documented, unreimbursed losses up to $5,000, or an “Alternative Cash Payment” with no receipts, “estimated to be approximately $100.00, but is subject to a pro rata increase or decrease based on the number of total approved claims.” The claim deadline is December 21, 2026. Nothing will be paid before the court decides on final approval at a telephonic hearing on January 11, 2027, and then only once any appeals are resolved.

The court describes ECSI as “a student loan and tax servicing vendor that provides services to universities in the United States,” and the class members as “current and former students of academic institutions that use ECSI’s services.” According to the notice, a criminal cyberattack hit ECSI’s website between October 29, 2023 and February 12, 2024. The plaintiffs allege that a “guest tax search” feature let anyone pull tax forms without logging in — “without requiring any login or identity confirmation or data security measures” — and that attackers reached information on Form 1098-E (student loan interest) and Form 1098-T (tuition) statements, including names and Social Security numbers. These are allegations; ECSI “denies the allegations made against it and denies that it is liable,” and the court has not found for either side. The judge did narrow the case on May 2, 2025, dismissing the implied-contract and invasion-of-privacy claims while letting negligence and other claims proceed; the parties held a full-day mediation on August 19, 2025 and reported a tentative deal on October 9, 2025.

The class is “all Persons residing within the United States whose Personal Information was potentially accessed in the Security Incident” — 2,577,994 potential class members by the count the court relied on. How do you know if you are one? The court ordered Angeion to send the notice by email where it has an address and by U.S. mail otherwise, within 45 days of the August 5 order — by our count, no later than September 19, 2026. If you are not sure, the notice says to “call the settlement administrator at 1-877-726-4268” or check DataSettlementECSI.com. If you object, the notice accepts “a copy of an original notice of the Security Incident” as proof that you are a class member.

There is no fixed amount. For most people the answer is the cash option, officially “approximately $100.00” and “calculated at the end of the settlement process.” The fund does not go straight to claimants: the claim form says it “will first be used to pay court-approved attorneys’ fees and costs, service awards for the class representatives … and the costs of administering the settlement.” Class counsel will ask for up to one-third, or $2,166,666.66, and five class representatives would get $2,500 each. That leaves at most $4,320,833.34 before administration costs, which have not been published — our arithmetic.

At $100 a claim, that pot covers roughly 43,208 cash claims, about 1.7% of the 2,577,994 people in the class (again our arithmetic, and before administration costs and documented-loss reimbursements, which come out of the same fund). If more people file, the $100 shrinks pro rata; if fewer file, it can grow. No claims count has been published as of October 14, 2026.

The documented option pays up to $5,000, but “not more than the documented loss proven.” It covers money lost between October 29, 2023 and December 21, 2026 that was “more likely than not caused by the Security Incident” — bank fees, per-minute phone or metered data charges, postage, gas for local travel, and credit reports, credit monitoring or identity-theft insurance bought in that window. You need real records such as bank or card statements, invoices or receipts; “self-prepared documents” like handwritten receipts are rejected on their own. You cannot take both options. Payment comes by PayPal, Venmo, Zelle or paper check, as you choose on the form.

To get paid: file online at DataSettlementECSI.com or mail the paper claim form to ECSI Security Incident Settlement Administrator, ATTN: Claim Forms, 1650 Arch Street, Suite 2210, Philadelphia, PA 19103. The claim deadline is December 21, 2026 (online, or postmarked by that date). You sign under penalty of perjury.

To keep your right to sue ECSI yourself: mail an exclusion letter, postmarked by November 20, 2026, to ECSI Security Incident Settlement Administrator, ATTN: Exclusion Requests, P.O. Box 58220, Philadelphia, PA 19102. It must include the case name and number, your full name, postal and email address, your own physical signature and a clear statement that you want to be excluded. You then get no money.

To object: stay in the class and file or mail a written objection, postmarked or filed by November 20, 2026, to the Clerk’s Office, Joseph F. Weis, Jr. U.S. Courthouse, 700 Grant Street, Pittsburgh, PA 15219, and to class counsel and ECSI’s counsel at the addresses in the notice. Class counsel must file the fee application by November 5, 2026 and the final approval motion by December 21, 2026; both will be posted on the settlement site. Leftover money from uncashed payments after 180 days goes to a second distribution if each recipient would get at least $5.00, otherwise to a court-approved charity; the order says the fund is “non-reversionary,” so nothing goes back to ECSI.

Yes. DataSettlementECSI.com calls itself “the official Settlement Website” authorized by the Western District of Pennsylvania, the court’s August 5 order “appoints Angeion Group, LLC as Settlement Administrator,” and the notice, claim form and court orders posted there match the case docket. Emails are expected: the court told Angeion to notify class members by email first. The phone number in the court-approved notice is 1-877-726-4268.

Basic precautions still apply, because scammers copy settlement emails. Type the address DataSettlementECSI.com yourself instead of following a link you are unsure about. The claim form asks for contact details and a PayPal, Venmo or Zelle handle — it does not ask for a fee, a bank password or your full Social Security number. The notice also asks people not to call the court, ECSI or ECSI’s lawyers about claims; questions go to the administrator.

This claim form is only for people whose information was potentially accessed in the ECSI incident between October 29, 2023 and February 12, 2024. If you are looking for a different breach settlement — for example a search for the “CRA data breach settlement” — this page and this claim form do not help; each settlement has its own case, administrator and claim website, which is printed on the notice for that case.

ECSI also faces other lawsuits that are not part of this settlement. Federal dockets show a case filed against it in the Eastern District of Michigan on August 13, 2026 (No. 2:26-cv-12839), where ECSI filed a motion to dismiss on October 13, 2026, and a self-represented case in the Eastern District of California filed September 4, 2026 (No. 2:26-cv-03012). The records we read do not say what those cases are about, and filing in this settlement does not depend on them. Bloomberg Law reported the preliminary approval on August 6, 2026; the official site is the place to watch for the January 11, 2027 decision and any payment date.