Two Companies, One Address, Two Different Letters — and a Single $850,000 Settlement That Closes October 22. You Do Not Need the Notice ID, and the Official Documents Disagree About Which Receipts Count.

People are searching for two different names because two different letters went out. Here is the relationship, as far as the public record actually establishes it — and no further.

EFS Advisors, LLC describes itself to state regulators as “an investment advisory firm with its headquarters in Cambridge, Minnesota.” It notified its own clients — and named beneficiaries of clients — on May 23, 2024.

Educators Benefit Consultants, LLC is “a third-party administrator that contracts with employers to administer employee benefit programs.” Its letter told recipients plainly: “You may also know Educators Benefit Consultants as Aviben.” That mailing went out on August 6, 2024 — seventy-five days after the first one.

They share a street address, 1995 E. Rum River Drive S., and they used the same outside lawyer for the breach notifications. Each was sued separately in Isanti County — Kennedy v. EFS Advisors, LLC, No. 30-cv-24-649, and Miller v. Educators Benefit Consultants, LLC d/b/a Aviben, No. 30-cv-24-659 — and the two cases were consolidated on January 29, 2025 into the first-filed one. That is why only the EFS name appears on the settlement today.

What we could not establish, and are not going to imply: a parent company, an ownership stake, a subsidiary relationship or any other corporate link between the two. None of the notification letters, none of the attorney-general filings and none of the four settlement documents names one. A shared address, a shared law firm and a shared outside IT provider are circumstances, not a corporate structure. One widely syndicated write-up describes the two as appearing jointly “as third-party employee benefits administrator Aviben”; no official filing supports that, and EFS never mentions Aviben in its own letters at all.

Either letter puts you in the same settlement. That is the practical answer most people are looking for.

Both companies describe the cause in one identical sentence, word for word: “The investigation determined that the incident resulted from a zero-day vulnerability in a software program used by an external IT provider (meaning a security vulnerability that is exploited before it has been patched by the software company).” Neither the provider nor the software is named anywhere.

California's breach registry records the incident dates as February 21, 22 and 23, 2024. The settlement agreement puts detection at “on or about February 22, 2024,” when “Defendants detected a data security incident where an unauthorized third party attempted to infiltrate Defendants' computer network during which the unauthorized actor may have acquired impacted individuals' Private Information.” Educators Benefit Consultants’ letter says the investigation “concluded on July 11, 2024”; the EFS letter names no closing date.

The data differs by person and by company. EFS told the Iowa attorney general the exposure covered “names, mailing addresses, dates of birth, driver's license numbers, bank account numbers, and/or Social Security numbers.” Aviben's letter to individuals adds military ID and passport numbers, and is explicit that “the types of information affected were different for each individual, and not every individual had all of the elements listed above exposed.”

There was a third mailing on March 26, 2025 — a later EFS notification, filed with Maine's attorney general and cross-referenced to the May 2024 one. How many people it covered is not published.

How many people in total? No settlement document says. We searched the notice, the 41-page agreement, the claim form and the preliminary approval order; the class size appears in none of them, only as a “Class List” the defendants hand the administrator. Figures of 31,042 and 39,640 circulate, sourced to Maine's breach database, which returned HTTP 403 to us three times running — so we are reporting them as unverified rather than as fact. What we read ourselves: 2,459 Iowa residents for EFS, plus 8 and 4 Rhode Island residents for the two companies. We have deliberately not added the two national numbers together: nobody says whether the two groups overlap.

The wording matters, and it is consistent across the documents: “the maximum amount Defendants will pay is $850,000.00, which includes all payments to Settlement Class Members, Class Counsel's award for Attorneys' Fees and Costs, Service Awards for the Class Representatives, notice and administration expenses, credit monitoring, and any other payments required under the Settlement.” The agreement adds: “Under no circumstances shall Defendants be obligated to pay more than $850,000.”

No document states a minimum. That is the difference between a cap and a common fund: money nobody claims is money nobody pays. We searched the full agreement for a floor and found none.

You may take the $50 or the documented losses, not both — the portal says so outright: “You cannot claim both Documented Out-of-Pocket Losses and the Alternative Cash Payment.” Credit monitoring stacks with either: “Individuals who elect an Alternative Cash Payment, however, are still eligible to elect Credit Monitoring.”

There is no lost-time payment in this settlement. That is a real finding, not a gap in our reading: we had the full text of the notice, the agreement and the claim form, and searched all three for “lost time,” “time spent,” “attested,” “self-certif” and “hourly.” Zero hits. Other settlements we read the same week pay attested time at $20 to $40 an hour; this one has no such route at all.

Arithmetic worth doing before you set expectations: $850,000 less up to $325,000 in fees and costs, less $7,500 in service awards, leaves at most $517,500 — and notice, administration and a year of three-bureau monitoring for everyone who elects it come out of that before a single $50 payment. Cash payments are explicitly subject to pro-rata reduction “so that the total payments do not exceed the Aggregate Cap.”

If you are claiming reimbursement for credit monitoring you bought after the breach, the eligible window depends on which document you read.

Two of three — including the contract that actually binds the parties and the form the administrator processes — say December 6, 2024. The aggregator write-ups have copied the notice's February date. Anyone submitting receipts from between February and December 2024 is relying on the minority version. We cannot tell you how the administrator will resolve it; we can tell you the safer course is to submit the receipts anyway and keep a copy, and to call 1-855-707-4306 if they are rejected.

There is a second, quieter mismatch, in who is even in the class. The judge's order defines it as “all living individuals in the United States who were sent a notice by Defendant that their Private Information was impacted in the Data Incident.” The agreement and the claim form define it as everyone “whose Private Information was potentially compromised”; the notice’s FAQ 5 says “potentially accessed.” If you were affected but never got a letter, one version includes you and the other does not — which is exactly the situation the claim portal seems built for (see below).

The claim form is the only route: “Submitting a Claim Form is the only way that you can receive Settlement Benefits.”

• Online: efsdatasettlement.com/submit-claim, until October 22, 2026.
• By mail, postmarked by October 22, 2026: EFS Data Security Incident Settlement, Attn: Claim Forms, 1650 Arch Street, Suite 2210, Philadelphia, PA 19103.
• Notice ID: not required. The paper form labels the field “Notice ID (if known),” and the online portal offers the option “I did not receive a notice” at the login screen.
• A lawyer: not required. Four firms are already appointed as class counsel at no cost to you, and the notice adds that you may hire your own “at your own cost and expense.”
• Payment methods: PayPal, Venmo, Zelle, virtual prepaid card or a mailed check.

Money moves only after the settlement is final: “Cash Benefits will also be issued by the Settlement Administrator only after the Settlement is approved and becomes Final … there may be appeals that must be resolved.” Nobody should expect a payment in 2026.

Preliminarily approved on June 5, 2026 by Judge Carrie A. Doom of the Isanti County District Court, Tenth Judicial District. The class is certified “for settlement purposes only,” and the defendants keep the right to argue it should never have been certified at all if the deal falls apart. The court “stays all proceedings in this Action until further order.”

No admission of anything: “Defendants do not in any way acknowledge, admit to, or concede any of the allegations.” And no ruling either way — “The Action has not gone to trial, and the Court has not decided in favor of the Plaintiffs or Defendants.”

One oddity we noticed and could not explain. The mediation before Michael Ungar took place on July 31, 2025 “which was ultimately unsuccessful,” and the very next paragraph says the parties reached agreement in principle “on January 28, 2025” — six months before the mediation it is supposed to have followed. Almost certainly a typo for 2026, but the correct year is not stated anywhere, so we are not asserting one.

We also could not check whether anything has happened on the docket since June 5. Minnesota state-court records run through a portal we could not query, and CourtListener does not carry state cases. The motion for final approval is due around September 22 under the order's own 45-day rule.