Via Credit Union Data Breach Lawsuit: The 2025 Case Was Dropped, a New Claim Surfaced
Case Dismissed
Via Credit Union, based in Marion, Indiana, was hacked in January 2025 and reported 60,853 people affected. One federal class action followed in March 2025 and was voluntarily dismissed within weeks. The reason people are searching now is different: on October 16, 2026 the Qilin ransomware group listed Via Credit Union on its leak site. Via has not confirmed a new breach, and as of October 19, 2026 no lawsuit, settlement or claim form exists for either incident.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Happened in the Via Credit Union Data Breach
There are two separate events under this name. Keep them apart.
The January 2025 breach (confirmed). In its own words, an unknown third party “accessed our computer system between January 18, 2025, and January 20, 2025, and acquired certain files.” Via says it detected suspicious activity on its internal network, brought in outside investigators and notified law enforcement. Beginning January 24, 2025, it determined the files held names, addresses, dates of birth, Social Security numbers, Visa credit card numbers and a form of financial account number. Via reported 60,853 people affected to the Maine Attorney General, sent notice letters (the plaintiff in the later lawsuit says she received hers around February 24, 2025), and offered one year of Experian IdentityWorks Credit 3B. It said it found no evidence the data had been misused.
The October 2026 claim (unconfirmed). Ransomware.live recorded Via Credit Union (viacu.org) as a victim of the Qilin group on October 16, 2026, with an estimated attack date the same day. The listing carries no description, and no data set, affected count or notice has been published. This is a claim by a criminal group, not a confirmed breach.
Case details
The only lawsuit we could document is Runyan v. Via Credit Union, No. 1:25-cv-00105, filed March 6, 2025 in the U.S. District Court for the Northern District of Indiana, Fort Wayne Division. It was a proposed nationwide class action under the Class Action Fairness Act. The complaint alleged that Via breached duties under common law, contract law, industry standards and the Federal Trade Commission Act, and that its notice was not timely or adequate.
Bloomberg Law reported on April 2, 2025 that the plaintiff had filed a notice of voluntary dismissal without prejudice. Without prejudice means the claims could be refiled; we found no refiled case. We could not open the court docket itself.
Status: No Active Lawsuit, No Settlement
October 2026 claim: unconfirmed, no lawsuit. As of October 19, 2026, Via had not posted a breach notice on its homepage, and we found no regulator filing and no lawsuit. Plaintiff firms have opened “investigations,” which is lead generation, not a case. If Via confirms a breach, expect notice letters and a state attorney general filing first; lawsuits usually follow those, not the other way round.
Are You Affected?
For the January 2025 breach, the test is simple: did you get a letter from Via Credit Union in or around late February 2025? Via said it notified 60,853 people. The letter lists which data was in your file. Keep it.
For the October 2026 claim, nobody can say yet. Via has not said which systems, if any, were affected, or whether member data was taken. Watch your mail and Via’s official channels rather than third-party pages. There is no list to check your name against.
Either way, there is nothing to sign up for. A class action includes members automatically if a class is certified or a settlement is approved.
What a Case Like This Pays
For context only, not a prediction: credit union breach settlements usually combine a small flat payment, reimbursement of documented losses and credit monitoring. The Carter Credit Union settlement, for about 105,185 people, offers $50 with no proof or up to $2,500 with receipts. The amount per person depends on the fund size, the number of claims and attorney fees. Our data breach settlement calculator shows how those factors interact.
Via Credit Union Breach Timeline
January 18–20, 2025 — The Intrusion
An unknown third party accesses Via’s computer system and takes files, according to Via’s notice.
January 24, 2025 — Personal Data Confirmed
Via begins determining that the stolen files contained names, Social Security numbers, Visa card numbers and account numbers.
February 24, 2025 — Notice Letters
Members receive letters around this date. Via reports 60,853 people affected to the Maine Attorney General and offers one year of Experian monitoring.
March 6, 2025 — Class Action Filed
Runyan v. Via Credit Union, No. 1:25-cv-00105, is filed in the Northern District of Indiana.
April 2025 — Voluntarily Dismissed
The plaintiff files a notice of voluntary dismissal without prejudice, as reported by Bloomberg Law on April 2, 2025. No settlement.
October 16, 2026 — Qilin Ransomware Claim
The Qilin group lists Via Credit Union on its leak site. As of October 19, 2026, Via had not confirmed a breach and no lawsuit was on file.
Three Things to Watch For
A fresh ransomware claim with no official details is exactly when fake notices and fake claim pages appear:
“Via Credit Union settlement” claim pages
There is no settlement for either incident, so there is no claims site. A page asking for your Social Security number or account number to “secure your payment” is collecting data, not filing a claim.
Calls or texts posing as Via’s fraud team
After a ransomware claim, criminals impersonate the credit union and ask you to “verify” your card, PIN or online-banking code. Hang up and call the number on the back of your card. Your credit union already has your details and will not ask for your PIN.
“Download the leaked data to see if you are in it”
Ransomware groups and resellers advertise leak files. Opening them is risky and does not tell you anything official. Wait for a notice letter from Via. That letter is the reliable proof of whether your data was involved.
Via Credit Union Data Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Is there a Via Credit Union data breach lawsuit right now?
Not that we could find as of October 19, 2026. The one documented case, Runyan v. Via Credit Union (N.D. Ind., No. 1:25-cv-00105), was voluntarily dismissed without prejudice in spring 2025. Law firms are “investigating” the October 2026 ransomware claim, but an investigation is not a lawsuit.
Was Via Credit Union hacked again in October 2026?
Unconfirmed. On October 16, 2026 the Qilin ransomware group listed Via Credit Union as a victim, with no description of what was taken. As of October 19, 2026, Via had not published a breach notice and we found no regulator filing.
How many people were affected by the 2025 breach, and what data was exposed?
Via reported 60,853 people to the Maine Attorney General. The exposed data included names, addresses, dates of birth, Social Security numbers, Visa credit card numbers and a form of financial account number.
How to claim data breach settlement money from Via Credit Union?
You can’t, because no settlement exists. If one is ever approved, a court-appointed administrator will send notice and run an official claim site, and the notice will give a deadline. Until then, any “claim form” is not real.
What is the typical payout per person for a data breach settlement?
It varies widely, and nothing applies to Via yet. As one current example, the Carter Credit Union settlement offers $50 with no proof or up to $2,500 with documented losses. Per-person amounts shrink when many people claim and after attorney fees are taken out of the fund.
Why was the 2025 lawsuit dropped?
The public reports don’t say. The plaintiff filed a notice of voluntary dismissal without prejudice, which ends the case without a ruling and leaves room to refile. We found no refiled case and no settlement.
Is it worth suing over a data breach?
That depends on your own losses and is a question for a licensed attorney. Breach class actions usually seek repayment of documented costs, compensation for lost time and credit monitoring. Without a filed case there is nothing for Via members to join, and you don’t need to sign anything to stay eligible for a future class.
What should Via members do right now?
Freeze your credit at all three bureaus; it is free and reversible. Check your Via account and card statements, and call the number on your card about anything you don’t recognize. Keep any notice letter from Via, including the one from February 2025.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Fairmont Federal CU Breach LawsuitAnother credit union breach case, still active, no settlement yet
- Data Breach Settlement CalculatorEstimate what breach settlements typically pay per person
- Open Class Action SettlementsSettlements you can file a claim in right now, with deadlines
- Settlement Payout CalculatorHow a fund is split after fees and the number of claims