Rumpke Waste & Recycling has agreed to settle a class action lawsuit for $750,000 related to a ransomware attack that exposed the personal data of nearly 17,000 current and former employees. The settlement, pending final approval in Hamilton County Common Pleas Court on April 16, 2026, provides eligible employees with cash payments up to $475 each, reimbursement for breach-related expenses up to $5,000, and one year of complimentary identity theft and credit monitoring services. For example, an employee who spent $2,000 on identity protection services, legal fees, and credit monitoring following the breach could seek reimbursement for those documented losses alongside the standard cash payment.
The October 2024 ransomware attack compromised over three terabytes of sensitive employee information, including Social Security numbers and other identifying details, after attackers made ransom demands. Rumpke discovered the attack following these extortion attempts and has stated that no customer payment information was affected and there is no evidence the stolen employee data has been misused. The settlement represents a resolution to the litigation without Rumpke admitting wrongdoing, though the company acknowledges the breach occurred.
Table of Contents
- What Did the Rumpke Ransomware Attack Involve and Who Was Affected?
- Settlement Compensation and What Eligible Employees Will Receive
- Identity Theft and Credit Monitoring Services Provided
- How to File a Claim and What Documentation Is Required
- The Settlement’s Admission of Liability and Rumpke’s Position
- Comparing This Settlement to Other Data Breach Settlements
- What Happens After the April 16 Settlement Approval and Timeline for Payments
What Did the Rumpke Ransomware Attack Involve and Who Was Affected?
The October 2024 ransomware attack on Rumpke Waste & Recycling affected nearly 17,000 current and former employees whose personal information was stolen by cybercriminals. The attackers encrypted Rumpke’s systems and demanded ransom, a common tactic in enterprise ransomware campaigns. Over three terabytes of data—roughly equivalent to 150 million pages of text documents—was exfiltrated from company systems before Rumpke discovered and contained the attack.
The compromised information included social Security numbers, names, addresses, and other personally identifying information that could be used for identity theft if sold or used by criminals. Unlike many corporate breaches, the Rumpke attack did not compromise customer financial data or payment information, limiting the scope of the incident to employee records. This distinction is important because customer payment data breaches typically trigger mandatory credit card company notifications and payment processor investigations. The attack primarily created risk for employees rather than customers, though the loss of Social Security numbers and identity information represents serious exposure that can lead to fraudulent accounts, credit damage, and years of monitoring and recovery efforts for affected individuals.
Settlement Compensation and What Eligible Employees Will Receive
Eligible employees affected by the Rumpke data breach will receive multiple forms of compensation under the $750,000 settlement. The cash component provides up to $475 per eligible employee as a flat payment, while a separate fund of up to $5,000 per person is available for those who can document specific breach-related losses. These documented losses might include costs for credit monitoring services, identity theft insurance, credit freeze services, legal consultations regarding identity theft, or actual fraud losses that resulted from the breach. An employee who purchased two years of credit monitoring after learning about the breach at a cost of $600 could submit those receipts for reimbursement through the separate $5,000 fund.
A significant limitation of the settlement is the finite pool of money divided among thousands of claimants. If total claims for documented losses exceed available settlement funds, payments will be reduced proportionately. Additionally, the reimbursement process requires claimants to submit receipts and documentation proving their losses, creating administrative burden and reducing the number of people who actually receive the maximum amounts. Many affected employees may not pursue reimbursement simply because the process requires gathering and submitting paperwork, meaning the settlement funds may not be fully claimed even if money remains available. Eligible employees will be notified by mail with instructions for filing claims, with deadlines that typically range from 90 to 120 days from the mailing date.
Identity Theft and Credit Monitoring Services Provided
Beyond cash compensation, Rumpke’s settlement provides one year of complimentary identity theft and credit monitoring services to all affected employees. This benefit includes credit monitoring from major bureaus, identity theft insurance, and alerts if Social Security numbers or other personal information appears on the dark web or in databases of compromised credentials. For employees who have not yet purchased identity monitoring services, this provision addresses the immediate need for protective measures following the disclosure of compromised Social Security numbers. The service typically covers identity restoration support if fraudulent accounts are opened in someone’s name.
However, one year of monitoring provides incomplete long-term protection, as identity fraud risks can persist for years after a breach. A person whose Social Security number was stolen may face fraudulent account applications or tax fraud attempts five or ten years later, long after the included monitoring period has ended. Employees must therefore decide whether to continue paying for monitoring beyond the one-year covered period or to implement their own protective measures like credit freezes with the three major credit bureaus (which are typically free and provide stronger protection than monitoring). The settlement’s monitoring provision addresses immediate post-breach needs effectively but does not eliminate the long-term exposure or the need for employees to make subsequent decisions about ongoing protection.
How to File a Claim and What Documentation Is Required
Employees affected by the Rumpke data breach will receive notification by mail from the settlement administrator with detailed instructions on how to file a claim. The claim process typically requires submitting a form with personal information verifying eligibility as a Rumpke employee at the time of the breach, along with documentation of any breach-related expenses being claimed for reimbursement. For the flat $475 cash payment, most settlements require only proof of employment or receipt of the notification letter. For the $5,000 reimbursement fund, claimants must provide receipts, invoices, or statements showing expenses directly caused by the breach, such as credit monitoring service bills or identity theft insurance premiums.
Documentation requirements vary in specificity and can present a barrier for some claimants. Some settlements require original receipts while others accept copies or electronic statements; some require affidavits swearing to the reasonableness of expenses while others simply require submission of documentation. Missing the claim deadline entirely means forfeiture of compensation, a consequence that affects employees who do not read their mail notification or misplace the claim instructions. Many settlement administrators offer online claim filing portals that simplify the process compared to mailing paper forms, but not all employees have equal comfort with digital claim systems. Employees should act promptly upon receiving notification and retain all documentation related to breach-related costs for several years in case questions arise about submitted claims.
The Settlement’s Admission of Liability and Rumpke’s Position
The settlement was structured with Rumpke neither admitting nor denying wrongdoing while acknowledging that the October 2024 ransomware attack occurred and employee data was compromised. This is a standard framework in many data breach settlements where the defendant company does not formally concede liability or violations of law, yet agrees to pay settlement funds to resolve the litigation. From a practical standpoint, the settlement fact that Rumpke agreed to pay $750,000 and provide identity monitoring indicates the company found settlement preferable to continued litigation, but from a legal standpoint, no judgment of liability was entered and Rumpke maintains it did not violate any legal duties.
A limitation for affected employees is that without a formal admission of liability, establishing negligence or legal violation requires using documents and evidence from the lawsuit itself rather than relying on the settlement as proof of wrongdoing. If an employee later pursues a separate legal claim against Rumpke or seeks damages beyond the settlement, the settlement does not establish that Rumpke was negligent or violated data protection laws. The settlement is designed primarily to compensate employees for their losses and provide identity monitoring, not to establish responsibility for how the breach occurred or whether Rumpke failed to maintain adequate cybersecurity. Employees concerned about whether Rumpke’s security practices were inadequate should review the lawsuit documents or cybersecurity analysis from the breach investigation rather than relying on the settlement terms as evidence of fault.
Comparing This Settlement to Other Data Breach Settlements
The Rumpke settlement’s structure and payment amounts fall within typical ranges for data breach settlements involving employee information. Many employee data breach settlements offer between $300 and $600 per affected person in cash payments, with additional reimbursement pools for documented losses. For comparison, a 2023 healthcare data breach affecting 1.3 million individuals provided $100 per person with a $49 million reimbursement fund, while a financial services breach affecting 60,000 employees provided $375 per person with a $5 million reimbursement fund.
Rumpke’s $475 cash payment per employee and $5,000 individual reimbursement cap aligns with mid-range settlements in terms of per-person value. The inclusion of one year of identity monitoring in Rumpke’s settlement is standard for breaches involving Social Security numbers and personal identifying information but insufficient relative to the scope and duration of identity theft risk. Some larger breach settlements provide three years or more of monitoring, and a few provide credit freezes instead, which provide stronger protection than monitoring. The Rumpke settlement does not include credit freezes with the three major bureaus, a gap that employees should address independently given that credit freezes are typically free and remain in place indefinitely unless the individual requests removal.
What Happens After the April 16 Settlement Approval and Timeline for Payments
The settlement is scheduled for final approval hearing in Hamilton County Common Pleas Court on April 16, 2026. Pending approval at that hearing, the settlement administrator will mail claim notification letters to affected employees at addresses in Rumpke’s personnel files. Claimants will have a limited window, typically 90 to 120 days from mailing, to submit claims. The processing of claims and distribution of settlement checks typically takes an additional 30 to 60 days after the claim deadline, meaning affected employees could receive payments by mid-to-late 2026 if the court approves the settlement and claim deadlines are met promptly.
Settlement approval is not guaranteed; the court could request modifications, delay approval, or reject the settlement if it determines the terms do not adequately protect the class. However, given that both Rumpke and the plaintiff attorneys have agreed to the settlement terms, approval is likely. Employees should watch for the notification letter in the mail and take care to respond by the deadline, as many settlement compensation programs go unclaimed because notification letters are discarded as junk mail or claim deadlines are missed. Setting a calendar reminder upon receipt of the notification letter can help ensure timely claim submission and avoid missing compensation eligibility.
You Might Also Like
- Varsity Brands $1.1 Million Data Breach Class Action Settlement
- T-Mobile $350 Million Customer Data Breach Class Action Settlement
- PharMerica $5.275 Million Patient Data Breach Class Action Settlement
Open Settlements You Can Claim Now
Browse current class action settlements accepting claims — several require no proof of purchase: