FAIRMONT, W.V. —The $603-million Fairmont Federal Credit Union has agreed to pay nearly $1.8 million to settle a class-action lawsuit alleging it failed to safeguard personal and medical information exposed in a cybersecurity breach that potentially affected more than 187,000 people.
The proposed $1,783,857.64 settlement, detailed in court-authorized notices in Butler v. Fairmont Federal Credit Union, would provide cash compensation and identity protection services to eligible individuals. The agreement is subject to final approval by the U.S. District Court for the Northern District of West Virginia. Fairmont Federal denies wrongdoing and the allegations against it, according to the official settlement notice.
Unauthorized actors accessed the credit union’s systems between Sept. 30 and Oct. 18, 2023, potentially exposing personally identifiable information and protected health information, according to the settlement administrator. Plaintiffs alleged negligence, negligence per se, breach of implied contract and breach of fiduciary duty.
187K Members Affected
According to a breach report filed with the Maine attorney general, 187,038 people were affected, including 53 Maine residents. The filing lists Sept. 30, 2023, as the date the breach occurred, Jan. 23, 2024, as the date it was discovered, and Sept. 11, 2025, as the date of written consumer notifications, the Maine AG said.
In a consumer notification filed with the Montana Department of Justice, Fairmont Federal said it learned of the incident around Jan. 23, 2024, hired outside cybersecurity specialists and concluded around Aug. 17, 2025, that files accessed or acquired by unauthorized parties contained personal information. The credit union said it was unaware of identity fraud directly resulting from the incident, the department said.
According to a media account republished by InsuranceNewsNet, the lawsuit was brought by Richard Butler of North Carolina and Timothy Knotts of Fairmont. The report said Butler alleged $25,000 had been stolen from his account, while Knotts alleged continuing exposure to identity theft risks. Those assertions are allegations, not findings by the court.
Settlement Benefits and Deadlines
Under the proposed settlement, eligible class members may seek reimbursement for documented, unreimbursed losses of up to $7,500, as well as compensation for up to four hours spent addressing the breach at $35 an hour, or $140. Alternatively, claimants may request a cash payment of up to $150 without documentation; that amount may be adjusted based on the number of valid claims. Eligible individuals may also claim three years of credit monitoring and identity restoration services, including $1 million in identity theft insurance.
Fairmont Federal also agreed to specified cybersecurity improvements, including training, for five years, according to the settlement administrator. The fund will also cover administration expenses, court-approved attorneys’ fees and costs, and potential awards to named plaintiffs. Class counsel may seek fees of up to one-third of the fund, or $594,599.74, subject to court approval.
The deadline to file claims, opt out or object is Dec. 18, 2026. A final approval hearing is scheduled for Feb. 8, 2027, at 2:30 p.m. Eastern time. Payments would follow final approval and resolution of any appeals, according to the court-authorized settlement website.
