Sovos Compliance Data Breach Settlement: $3.53 Million MOVEit Deal, Benefits and Status

Sovos Compliance, LLC used the MOVEit Transfer file-sharing application to help its business customers handle unclaimed property services. According to the settlement website, on or about May 30, 2023, a zero-day vulnerability in MOVEit led to unauthorized access to or acquisition of the private information of approximately 490,000 individuals.

Affected people sued in federal court in Massachusetts, and the cases were consolidated before Judge Angel Kelley. Data breach suits like this usually allege the company failed to protect personal information and seek compensation for time lost, out-of-pocket costs, and the risk of identity theft. Sovos maintained it had defenses and was prepared to defend the case; the settlement is not a finding of wrongdoing.

The same MOVEit flaw hit many other organizations in 2023, and hundreds of separate lawsuits followed. For how these cases generally work, see our data breach lawsuit guide.

The settlement class was all living individuals residing in the United States who were sent a notice by Sovos or by a Sovos customer saying their private information may have been affected by the data incident. A California subclass covered class members living in California on May 30, 2023.

Excluded were employees, directors, officers, and agents of Sovos or a Sovos customer and their affiliates; governmental entities; and the judge, her immediate family, and court staff. Because many notices came from Sovos customers, check any 2023 breach letter you received that mentions Sovos, MOVEit, or unclaimed property.

Staying in the class meant releasing claims not just against Sovos but also against the Sovos customers that provided your information to it. Our guide to being bound by a class settlement explains what that release means.

Each class member with a valid claim picked one cash option, and could add credit monitoring:

Benefit	Amount	Proof
Cash Payment B (flat)	$150	None
Ordinary losses (Payment A)	Up to $2,000	Documents
Lost time (Payment A)	$25 per hour, up to $125	Attestation
Extraordinary losses (Payment A)	Up to $10,000	Documents
California Statutory Award	$100 extra	California resident

Credit monitoring included three-bureau monitoring, dark web scanning, public record monitoring, identity theft insurance, and fraud resolution help. All cash amounts could rise or fall pro rata depending on how many valid claims were filed, with credit monitoring paid first. The court awarded class counsel $1,177,925.02 in fees and $13,825.99 in costs, and $2,500 service awards to each class representative, all from the fund. We could not find a public report of final per-person payment amounts. See how much data breach settlements are worth for typical ranges.

Claims were filed online at the court-authorized settlement website or by mail to Kroll Settlement Administration. Notices carried a Class Member ID that claimants used on the claim form. The choice of cash option drove what proof was needed:

• Flat $150 (Cash Payment B): no documentation, just a valid claim from a class member.
• Documented losses (Cash Payment A): receipts or statements showing unreimbursed out-of-pocket costs fairly traceable to the incident, up to $2,000 for ordinary losses and up to $10,000 for extraordinary losses.
• Lost time: up to five hours at $25 per hour, supported by an attestation briefly describing what you did in response to the breach.

Most people with no out-of-pocket losses were better off choosing the flat $150 option, since lost time alone was capped at $125. Payments were to be made by check or electronic transfer from the net fund. Our guide on filing a settlement claim covers how to document losses for future breach settlements.

Event	Date
Data incident	On or about May 30, 2023
Preliminary approval	February 12, 2024
Claim deadline	June 10, 2024
Opt-out and objection deadline	June 24, 2024
Final approval	July 23, 2024

Judge Kelley signed the final approval order in Boston on July 23, 2024, the same day as the hearing. As of September 2026, the court-authorized website run by Kroll Settlement Administration is offline, which typically follows the end of distribution, though we could not find a public statement of when payments were sent. If you filed and never received anything, contact Kroll at (833) 462-4282 or P.O. Box 5324, New York, NY 10150-5324, and see our guide on what to do if a settlement check never arrived.

If you did not file by June 10, 2024, you cannot receive money from this settlement, and unless you opted out by June 24, 2024, you gave up the right to sue Sovos or its customers over this incident. You can still protect yourself: freeze your credit at all three bureaus, watch account statements, and use free monitoring offered in any breach letter. Our checklist on what to do after a data breach notice covers each step.

If identity theft or fraud has already cost you real money and you were not part of this class, or you have a notice from a different, newer breach, a free case review can connect you with independent attorneys who handle data breach cases. For breaches with claims open now, browse our open settlements list, including the Labcorp data breach settlement and the Spectrum data breach page.