US Bank Class Action Lawsuit: Breach Notices, LockBit Claim and a 401(k) Settlement
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Most people looking for a class action lawsuit US Bank customers can join, or a class action suit against US Bank, are reacting to breach letters. U.S. Bank sent notices over a vendor incident at FIS in June, was named on a LockBit extortion site in August, and filed another notice in Vermont in September. As of October 8, 2026 we found law firms investigating, but no filed data breach lawsuit, no settlement and no claim form. The one live U.S. Bank class settlement is a $250,000 deal for 401(k) plan participants, and it needs no claim form.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Is Actually Going On
There is no single “US Bank class action.” Several separate things share the name, and only one of them involves a settlement.
The FIS vendor incident. On May 7, 2026 U.S. Bank was told that a third-party provider supporting its vendor, Fidelity National Information Services (FIS), had a security incident. The bank confirmed on May 19, 2026 that customer data was affected. Per the Massachusetts filing, the exposed fields were name, mailing address and credit card number; Social Security numbers were not listed.
The LockBit claim. On August 20, 2026 the LockBit ransomware group listed U.S. Bancorp on its extortion site with a 14-day countdown to September 3 and no sample data. The bank said the claim relates to a “fourth party” event outside its environment, with no evidence its own systems were compromised. That is the bank's statement; the group's claim is unverified.
Later state filings. Further notices list Social Security numbers alongside card or account data.
Case Details
Data breaches: no court case located. Law firms have announced investigations of a potential class action; an investigation is not a lawsuit. Our federal docket check was rate-limited, so a very recent filing cannot be ruled out.
401(k) fees: Dionicio et al. v. U.S. Bancorp et al., Case No. 0:23-cv-00026-PJS-DLM, U.S. District Court for the District of Minnesota, before Judge Patrick J. Schiltz. It is an ERISA case challenging plan recordkeeping fees.
Cash sweep: Futo v. U.S. Bancorp, No. 0:25-cv-01464, also in Minnesota, was dismissed with prejudice by Judge Eric Tostrud on January 30, 2026.
Card interchange fees: U.S. Bancorp is tied to the Visa and Mastercard interchange litigation through Visa's member indemnification. That case is about merchants, not cardholders.
Status as of October 2026
401(k) settlement: pending final approval as far as we can confirm. The objection deadline was August 5, 2026 and the fairness hearing was set for August 19, 2026. The official site, run by Analytics Consulting LLC, did not show a final approval order when we checked on October 8, 2026, so no payment date is set.
Cash-sweep case: dismissed on January 30, 2026. Interchange: the merchant settlement has a final approval hearing on November 16, 2026.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Who Is Affected by Which Matter
FIS card incident: U.S. Bank credit card holders who received a notice mailed on or around June 30, 2026. The Massachusetts filing alone listed 537 residents of that state; no national total has been published.
September Vermont notice: people who received a letter about Social Security numbers, financial account codes and card or account information. An aggregator reported that the filing covered eight Vermont residents; the filing gave no incident date.
LockBit claim: nobody has been notified in connection with it, and the bank has not named the vendor involved.
401(k) settlement: participants in, or beneficiaries of, the U.S. Bank 401(k) Savings Plan at any time from January 5, 2017 through final approval — about 93,000 people. This is for employees and former employees, not bank customers.
Your letter is the test. Keep it and the envelope.
Is There Money, and How Much?
401(k): the fund is $250,000 for a class of about 93,000, which Bloomberg Law reported as about 26% of the losses the plaintiffs claimed. Spread across the class, individual shares are likely to be small. You do nothing to get yours: the official site says that if the court approves the settlement, eligible participants receive their share automatically.
US Bank Lawsuit and Breach Timeline, 2026
- 1
January 30, 2026 — Cash-Sweep Suit Dismissed
Judge Eric Tostrud dismisses Futo v. U.S. Bancorp with prejudice. The court found the program disclosures said there was no obligation to pay the highest available rate.
- 2
May 7, 2026 — FIS Vendor Incident Reported
U.S. Bank learns that a provider supporting its vendor FIS had a security incident. It confirms on May 19 that customer card data was affected.
- 3
June 30, 2026 — Breach Letters Mailed
Notices go to affected cardholders with replacement cards and 12 months of credit monitoring. The Massachusetts filing follows on July 3.
- 4
August 19, 2026 — 401(k) Fairness Hearing
The hearing on the $250,000 Dionicio settlement was scheduled in Minnesota federal court, after the August 5 objection deadline. We could not confirm an outcome as of October 8, 2026.
- 5
August 20, 2026 — LockBit Listing
The ransomware group names U.S. Bancorp with a September 3 deadline and no sample data. The bank says the event occurred at a fourth party, outside its environment.
- 6
September 9, 2026 — Vermont Notice; No Suit Located
A new notice lists Social Security numbers and account data. As of October 8, 2026 law firms are investigating, but we found no filed breach lawsuit and no settlement.
Three Things to Watch For
Breach letters, a ransomware headline and a real settlement under one brand name is an easy mix for imposters:
“Claim your US Bank data breach payment”
There is no breach settlement and no claim form. A site asking for your card number or Social Security number to “register” is collecting data, not filing a claim.
Calls about your “compromised” card
Card numbers were exposed in the FIS incident, so callers sound believable. Hang up and call the number on the back of your card. The bank reissues cards itself; it does not need your PIN or a one-time code.
401(k) “release fee” requests
The $250,000 settlement pays automatically if approved. No legitimate administrator charges a fee or asks for plan login details to release your share.
US Bank Class Action — Questions People Actually Ask
Is there a US Bank data breach class action lawsuit?
As of October 8, 2026 we found law firms investigating a potential class action, but no filed breach lawsuit and no settlement. Our federal docket search was rate-limited, so a very recent filing is possible.
I got a US Bank breach letter. What happened?
If it was mailed around June 30, 2026, it concerns the FIS vendor incident: name, mailing address and credit card number. If it is dated September 2026 or mentions your Social Security number, it is a later notice. Your letter states which fields applied to you.
Did LockBit hack U.S. Bank?
LockBit claimed it did on August 20, 2026, but it posted no sample data. U.S. Bank says the event happened at a fourth party outside its environment, with no evidence its own systems were compromised. The bank has not named the vendor.
Is there a claim form or deadline?
Not for any breach. For the 401(k) settlement there is no claim form either; the objection deadline was August 5, 2026. The FIS credit monitoring offer has its own enrollment deadline of January 31, 2027, printed with the code in your letter.
Who gets money from the US Bank 401(k) settlement?
Participants and beneficiaries of the U.S. Bank 401(k) Savings Plan at any time from January 5, 2017 through final approval. The suit alleged annual recordkeeping fees of about $29 per person were excessive. Payment follows final approval, which we could not confirm as of October 8, 2026.
What happened to the US Bank cash sweep lawsuit?
Futo v. U.S. Bancorp, No. 0:25-cv-01464, was dismissed with prejudice on January 30, 2026. Brokerage customers in that program get nothing from it.
Is there a US Bank lawsuit over card swipe fees I can join?
The interchange case against Visa and Mastercard is a merchant case. The current settlement there has a final approval hearing on November 16, 2026. Cardholders are not the class.
What should I do now?
Activate the replacement card if you received one, enroll in the monitoring using the code in your letter, and consider a free credit freeze at all three bureaus. Keep every letter. If a breach suit is filed and settles, that letter is your proof.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Open Class Action Settlements
Settlements currently accepting claims, with deadlines
Data Breach Settlement Calculator
What breach settlements typically pay per person
Settlement Payout Calculator
Estimate a per-person share from a fund and claim rate
Synchrony Bank Class Action Lawsuit
Another card issuer, separate cases and status