KYB’s Breach Settlement Covers 2,041 People and Caps Cash at $250,000. If Every Single One of Them Took the $75, the Cap Still Would Not Bind — With $96,925 Left Over

Two facts about the KYB Americas data breach settlement are published in different places and almost never put next to each other.

Fact one: the settlement has an “aggregate cap of $250,000.00,” and payments “reduce proportionally if claims exceed this amount.”

Fact two: court documents state the settlement covers 2,041 people.

Put them together and the cap looks very different from the way caps usually work:

• 2,041 class members × $75 alternative cash payment = $153,075
• Aggregate cap = $250,000
• Headroom if literally every eligible person claimed the no-proof payment = $96,925

In other words, the pro-rata reduction mechanism cannot be triggered by alternative cash payments alone, even at a 100 percent claim rate — a claim rate no consumer settlement has ever achieved. Typical claim rates in data breach settlements run in the low single digits to the mid teens. At a 10 percent rate here, alternative payments would total roughly $15,300 against a $250,000 ceiling.

The administrator’s own wording points in the same direction. The payment is “expected to be $75.00, but may be larger or smaller depending on the total claims filed.” We want to be careful about how far to push that: “may be larger” is the administrator’s language, and the arithmetic above shows the downward pressure is unlikely to come from alternative payments. We are not telling you the payment will definitely exceed $75 — that depends on the plan of allocation and on how much the documented-loss claims draw down, and those claims can run to $5,000 apiece. We are telling you the usual reason to be pessimistic about a capped settlement does not apply with this class size.

Class members choose one of two cash routes, and everyone can take the credit monitoring on top.

Option A — documented losses. Three separate limits, which stack:

• Up to $300 for ordinary out-of-pocket expenses
• Up to $5,000 for extraordinary losses from identity theft or fraud
• Up to $100 for lost time, calculated at $25 per hour for a maximum of four hours

The eligible loss window runs from February 11, 2025 through August 26, 2026. Documentation is required.

Option B — alternative cash payment. “Expected to be $75.00,” no documentation required.

Credit monitoring — available regardless of which cash option you pick. Three years of CyEx Financial Shield Complete, including $1 million of financial fraud insurance. Three years is longer than the two years offered in most breach settlements of this size, and it is the benefit people most often skip because it does not arrive as money.

The class is defined as “All individuals residing in the United States whose Personal Information was compromised in the Data Security Incident discovered by KYB in February 2025.”

The two dates in this settlement run in an order that catches people out:

• Claim deadline: August 26, 2026
• Final approval hearing: September 25, 2026

That is a thirty-day gap in which the claim window is shut and the settlement is not yet approved. It is a completely normal structure — courts routinely set the claims deadline first so the administrator can report claim volumes at the fairness hearing — but it has a practical consequence: waiting to see whether the judge signs off is not an option. By the time there is anything to see, filing is over.

The case is Johnson et al. v. KYB Americas Corporation, Case No. 49D01-2508-CE-038312, in the Indiana Commercial Court in the Marion County Superior Court, filed June 2, 2025. The official claim site is kybdatasettlement.com.

KYB Americas Corporation is the U.S. arm of KYB Corporation, a supplier of hydraulic components for the automotive, aerospace and construction industries. According to the settlement materials, personal information in KYB’s systems may have been accessed and acquired by an unauthorised third party between February 11 and February 17, 2025. KYB detected suspicious activity on February 18, 2025, after certain systems became inaccessible, and began mailing notification letters on April 22, 2025.

Separately, the ransomware group Cactus publicly claimed responsibility and said it had taken 1.8 TB of data. We flag that as an attacker claim reported in the security trade press — not confirmed by KYB and not part of the settlement record. Ransomware crews routinely inflate what they took, and a claimed volume is not evidence of what was actually exfiltrated or of what was in it.

A note on who is in this class. Because KYB Americas is a parts manufacturer rather than a consumer brand, a large share of a 2,041-person class of this kind is typically current and former employees and their dependants rather than customers. If you received a letter from KYB Americas dated on or around April 22, 2025 and set it aside because you have never bought anything from the company, that letter is still the thing that puts you in this class.