Cadence Bank data breach settlement: the $5.25 million MOVEit deal

What happened at Cadence Bank

Cadence Bank's own notice letter, filed with the California Attorney General and dated September 15, 2023, sets out the sequence. Cadence learned of the MOVEit zero-day vulnerability on June 1, 2023. On June 18, 2023, its investigation found that an unauthorized party had used the flaw to reach and download files stored in the application between May 28 and May 31. The bank's data review tied individual people to the stolen files on August 16, 2023, and it began mailing notices about a month later.

The data named in the letter covers names, addresses, dates of birth, Social Security numbers, driver's license numbers and financial account details such as card numbers, bank account numbers and account statements. The letter adds that not every element was involved for every person, and that Cadence knew of no fraud or identity theft tied to the incident when it wrote. It offered free identity protection services through IDX, with enrollment open until December 15, 2023. The underlying vulnerability was in Progress Software's product, not in Cadence's own code; this site's Progress Software MOVEit entry covers the vendor's side and what the breach has cost it.

How many people the settlement covers

The settlement class is everyone in the United States whom Cadence Bank notified that their personal information was in the files affected by the MOVEit breach. Cadence itself, its senior executive management, the judges on the case and anyone who opted out are excluded. ClassAction.org, reporting from the settlement agreement, put the class at about 869,411 people. Cadence's own notice letter is a template and gives no total. Figures elsewhere online that differ from it come with no court or company source.

What the settlement pays

The money goes into one $5.25 million fund. Claims, the cost of notice and administration, a service award to the named plaintiff and the class lawyers' fees all come out of it. A class member could choose one of two paths, and anyone could also claim credit monitoring on top:

• Alternative cash payment: $100. No documents needed. The figure moves up or down pro rata with the number of claims, and it can rise to as much as $1,000 if valid claims leave money in the fund.
• Ordinary losses: up to $2,500. Documented out-of-pocket costs such as bank fees, postage and credit reports, plus up to four hours of lost time at $25 an hour.
• Extraordinary losses: up to $10,000. Proven monetary losses that were more likely than not caused by the breach and happened between May 31, 2023 and the end of the claims period.
• Credit monitoring: two years. Three-bureau monitoring with Equifax, Experian and TransUnion, dark web monitoring and up to $1 million in identity theft insurance.

None of the fund goes back to Cadence. Money still unclaimed 180 days after the settlement takes effect pays for longer credit monitoring for the people who signed up for it. Class counsel said they would ask for up to 33% of the fund in fees, plus a service award of no more than $2,500 for the named plaintiff.

The case and its timeline

The case is Pratt v. Cadence Bank, No. 1:23-cv-12996-ADB, brought by plaintiff Tammy Pratt in 2023 and coordinated in the District of Massachusetts with In re: MOVEit Customer Data Security Breach Litigation, MDL No. 1:23-md-03083, before Judge Allison D. Burroughs. The complaint alleged negligent data security. Cadence denies the allegations and denies any wrongdoing, and the court has made no finding for either side. Law360 reported that Cadence is one of more than 100 company and government defendants in the MOVEit MDL. The settlement covers Cadence only; claims against Progress Software continue.

Date	Step
May 28-31, 2023	Files taken from Cadence's MOVEit Transfer application
September 15, 2023	Cadence begins mailing breach notices
December 15, 2025	Parties sign the settlement agreement, after mediation before retired Judge Diane M. Welsh
January 5, 2026	Court grants preliminary approval (Document 1661)
March 6, 2026	Deadline for notice to the class
April 14, 2026	Class counsel's fee application due
May 5, 2026	Opt-out and objection deadline
June 4, 2026	Claim deadline
July 9, 2026	Final approval hearing, Courtroom 17, Boston

The settlement agreement's date and the mediator's name come from the court's preliminary approval order. Law360 reported the plaintiff's motion for preliminary approval in December 2025, quoting it as calling the deal fair, reasonable and adequate. Payments under the deal are made only after the court grants final approval and any appeals are resolved.

How it compares with other MOVEit settlements

Cadence's terms match the pattern now common in the MOVEit MDL: a fixed fund, a choice between a flat payment and documented losses, and credit monitoring for everyone. Law360's report said the structure resembles allocation plans courts have approved in other data breach cases. Measured per person, $5.25 million across about 869,411 class members works out to roughly $6 a head before fees and costs, which is why the $100 flat payment depends on how few people claim. That per-person figure is our own arithmetic from the two numbers above. For how breach suits get filed, consolidated and moved into an MDL, see class actions after a disclosed breach. The TD Ameritrade MOVEit entry follows another bank-side defendant in the same MDL.

FAQ

What is the Cadence Bank data breach settlement? It is a $5.25 million class action settlement Cadence Bank reached in December 2025 to resolve negligence claims over the May 2023 MOVEit Transfer breach. The case is Pratt v. Cadence Bank, part of the MOVEit multidistrict litigation in federal court in Massachusetts. Cadence denies wrongdoing.

Who is eligible for the Cadence Bank settlement? Anyone in the United States whom Cadence Bank notified that their personal information was in files affected by the MOVEit breach, about 869,411 people according to the settlement agreement. Cadence, its senior executive management, the judges on the case and anyone who opted out are excluded.

How much can I get from the Cadence Bank MOVEit settlement? Either a $100 cash payment, adjusted up or down with the number of claims, or reimbursement of documented ordinary losses up to $2,500 and extraordinary losses up to $10,000. All class members could also claim two years of credit monitoring.

What is the Cadence Bank settlement claim deadline? Claims had to be submitted online or postmarked by June 4, 2026. The deadline to opt out or object was May 5, 2026. Both dates have passed.

When will Cadence Bank settlement payments be sent? Only after the court grants final approval and any appeals are resolved. The final approval hearing was set for July 9, 2026; as of November 11, 2026 we found no final approval order in the sources checked, and the settlement website had posted no payment date.

Is the Cadence Bank breach part of the MOVEit hack? Yes. Cadence's notice says an unauthorized party exploited the zero-day vulnerability in Progress Software's MOVEit Transfer and downloaded files stored in Cadence's MOVEit application between May 28 and May 31, 2023.

For more companies with a disclosed incident and the litigation that followed, see the data-breach class-action litigation tracker and the breach outcomes cross-reference.