YES Communities' Ransomware Settlement Pays a Flat $50 With No Proof — and Unlike Most Breach Deals There Is No Fund to Run Out, Because the Company Pays Every Valid Claim Separately; 10,675 People, Claims Close November 5

YES Communities is not a household name outside the industry, but the settlement agreement's first sentence explains its reach: the company “owns manufactured home communities located in 23 states.” It is one of the largest operators of what used to be called mobile-home parks in the country, headquartered in Denver.

The official settlement FAQ lays out what happened: “On or about December 11, 2024, Defendant became aware of anomalous activity within its computer network, which involved certain files being encrypted by ransomware.” The forensic investigation “determined that between December 9 and 11, 2024, Defendant experienced a ransomware attack that resulted in unauthorized access to its systems and theft of unencrypted Private Information belonging to 10,675 individuals located in the United States or its territories.”

The list of what was taken is longer than the usual name-and-Social: “name, Social Security number, driver's license number, passport number, state ID card number, financial and credit/debit account information, visa/work eligibility documentation, employee identification number/tax ID number, non-US national identification number, and date of birth.” Passport numbers, work-eligibility documents and employee ID numbers are the fields an employer holds, not the ones a landlord collects on a lease application — the FAQ does not say who the 10,675 are, and neither will we, but the data list points at least partly toward YES Communities' own workforce. Letters went out starting February 24, 2025; the company's filing with the Iowa Attorney General on that date, for example, covered 648 Iowa residents and described the involved fields for them as name and Social Security number.

Almost every breach settlement we cover starts with a dollar figure: a fund that pays the lawyers, the administrator and the class, in that order, with the no-proof payment absorbing whatever is left. This one has no such number, and the reason is structural. Under the amended settlement agreement, “The Settlement Administrator must submit an invoice to Defendant for payment of all Valid Claims within 30 days of the Effective Date … Defendant shall pay or cause to be paid to the Settlement Administrator the invoiced amount of all Valid Claims within 10 days of the invoice.” Every valid claim is paid at its stated amount. There is nothing to run out.

The other costs are walled off the same way. Attorneys' fees and costs of “$217,000.00, to be paid by or on behalf of Defendant separate from Defendant's obligation to pay Settlement Administration Costs and the Settlement Class Member Benefits.” Service awards of up to $2,500 for each of the five named plaintiffs, “payable separate from the Settlement Class Member Benefits.” And the FAQ: “Defendant shall be solely responsible for the payment of all Settlement Administration Costs.”

The practical difference is large. In Central Maine Healthcare's settlement, the $50 is an estimate that moves with the claim rate; in ConnectOnCall's, the $75 is a ceiling that shrinks if too many people file. Here, $50 means $50, and a neighbor filing does not cost you anything. The trade-off, as always with claims-made settlements, is that the company's total exposure is capped by how many people bother — which, with a 10,675-person class and a $50 alternative, will not be many.

Cash Payment A — Documented Loss: up to $2,500. For “reasonable documentation of losses related to fraud and/or identity theft as a result of the Data Incident” — the loss must be actual, unreimbursed, more likely than not caused by the breach, and incurred after it. The FAQ is specific that “personal certifications, declarations, or affidavits from the Settlement Class Member do not constitute proper documentation.”

Cash Payment B — Lost Time: $20 an hour, up to four hours, $80 maximum. Attested, not documented. One detail to get right on the form: “If a Settlement Class Member fails to identify how many hours of time spent on the Claim Form, the Settlement Administrator may interpret such a Claim as a submission for one hour of time” — a blank costs you $60.

Cash Payment C — Alternate Cash: $50. “As an alternative to Cash Payment A – Documented Losses and Cash Payment B – Lost Time … There is no documentation required to claim this benefit.” Read that structure carefully: A and B sit together, and C is the alternative to both. Someone with $300 of documented losses and three hours of phone calls claims A plus B for $360; someone with neither claims C for $50. Nobody claims C on top of A or B.

Credit Monitoring: three years through IDX, one bureau — “in addition to a Cash Payment,” and “regardless of whether they previously received a credit monitoring product related to the Data Incident.” Payment options on the claim form include check, PayPal, Venmo, Zelle and a virtual prepaid card. The agreement gives the administrator 60 days from the Effective Date to send cash and email monitoring activation codes.

Wednesday, October 21, 2026 is the postmark deadline to opt out — a personally signed letter to YES Communities LLC Data Incident, c/o Analytics Consulting LLC, P.O. Box 2002, Chanhassen, MN 55317-2002 — and the deadline to object, filed with or mailed to the Clerk of the U.S. District Court for the District of Colorado at the Alfred A. Arraj Courthouse, 901 19th Street, Denver, with copies to class counsel, defense counsel (Mullen Coughlin) and the administrator. Group opt-outs by an attorney “will not be accepted.”

Thursday, November 5, 2026 is the claim deadline — submitted online or postmarked. From today that is 67 days. The FAQ's plain rule: “You must file a Claim Form to receive benefits from the proposed Settlement.” Doing nothing means “you will not get any money or credit monitoring services.”

Friday, November 20, 2026 at 10:00 a.m. is the final approval hearing, at 901 19th Street, Denver, Courtroom A701. The site warns it “may be moved to a different date, time, or location without additional notice.”

The case is O'Leary v. YES Communities, LLC, in the U.S. District Court for the District of Colorado. The amended settlement agreement's caption gives the number as 25-cv-00692-PAB-NRN, consolidated with four other cases (25-cv-00698, -00728, -00819 and -00937), with five named plaintiffs — Michelle O'Leary, Teresa Starks, Terry Wilkins, Brenton Kay and Jasmin Burns — and five appointed class-counsel firms: Kopelowitz Ostrow, Strauss Borrelli, EKSM, Mason LLP and Milberg. One small thing to know if you look the case up: the official site prints the number as “1:25-cv-69” on its home page and “1:25-cv-692” in the FAQ. Both are truncations of the same docket.