How the Infosys McCamish settlement payment works

The Infosys McCamish data breach settlement is a court-approved agreement that provides money to people whose personal information was exposed in a 2021 incident. Infosys, a large IT services company, had a contract to manage benefits data for McCamish International, which handles insurance and retirement accounts. When hackers accessed that data, names, Social Security numbers, dates of birth, and financial account information were compromised for roughly 3,000 people.

The settlement does not require you to prove you suffered specific harm. Instead, it divides a fixed pool of money among all people whose data was exposed. You receive a payment based on your category — whether you had to spend time addressing the breach, whether you had to pay for credit monitoring, or whether you simply had your information exposed. The settlement administrator handles all payments; Infosys does not send money directly to individuals.

This is a one-time payment. Once you receive it, you have no further claim against Infosys or McCamish related to this breach, and you cannot sue them separately for the same incident.

Key Takeaways

  • The settlement pays people whose data was exposed in the 2021 Infosys McCamish breach, with payment amounts based on how much time or money you spent responding to the breach.
  • You do not have to prove you were harmed; the settlement administrator determines your payment category based on the claim you submit.
  • Payment comes from a settlement fund managed by a court-appointed administrator, not directly from Infosys.
  • You must submit a claim by the deadline set by the settlement administrator to receive money; missing the deadline means you forfeit your payment.
  • Accepting the settlement payment means you give up the right to sue Infosys or McCamish separately over this breach.

Who is covered by the settlement

You are covered if your personal information was in the McCamish database that Infosys managed and was exposed in the 2021 breach. This includes people who had insurance policies, retirement accounts, or other benefits administered through McCamish at the time of the breach. The settlement covers roughly 3,000 individuals, though the exact number depends on how many claims are submitted.

You do not need to have suffered financial loss or identity theft to receive a payment. The settlement assumes that having your data exposed creates harm — time spent monitoring accounts, stress, and the risk of future fraud — even if nothing has happened yet. This is why people receive payments in different tiers based on the effort they put into responding, rather than based on actual losses they can document.

Payment amounts and claim categories

The settlement divides money into tiers. The exact amounts depend on how many valid claims are submitted, because the total fund is fixed and split among all claimants. Typically, settlements of this type pay between $500 and $5,000 per person, but your specific amount will be determined by which category your claim falls into.

The categories usually work like this: the lowest tier covers people who simply had their data exposed but did not spend time or money responding. The middle tier covers people who spent time monitoring their accounts or checking credit reports. The highest tier covers people who paid for credit monitoring services, spent significant time on the breach, or had to deal with identity theft or fraud as a result.

When you submit your claim, you provide documentation of what you did in response to the breach — receipts for credit monitoring, records of time spent, proof of fraud if it occurred. The settlement administrator reviews your submission and assigns you to the appropriate tier. You do not negotiate the amount; the tier determines it.

How to submit a claim

The settlement administrator sends notice to all known affected individuals at their last known address. That notice includes a claim form, a deadline for submission, and instructions for how to file. You can usually submit your claim by mail or online through the settlement website.

When you file, you provide your personal information to confirm you were in the exposed database, and you describe what you did in response to the breach. If you paid for credit monitoring, include the receipt or billing statement. If you spent time on the matter, describe what you did and how long it took. If you experienced fraud or identity theft, provide documentation — police reports, credit card statements showing unauthorized charges, letters from creditors, or correspondence with your bank.

Keep copies of everything you submit. The administrator may ask follow-up questions if your claim is unclear or if the documentation does not match the tier you are requesting. Respond promptly to any requests for more information, because missing a deadline to respond can result in your claim being denied or reduced.

Deadlines and what happens if you miss them

The settlement administrator sets a claim deadline, usually 60 to 90 days from when notice is mailed. This is a hard deadline. If your claim arrives after that date, it will be rejected, and you will not receive any payment from the settlement. There is no extension process and no way to file late.

If you receive notice but do not recognize it as important, or if the notice goes to an old address and you never see it, you still miss the deadline. This is why it is critical to act as soon as you receive settlement notice. If you think you may have been affected but have not received notice, you can contact the settlement administrator directly using the case name and number to ask whether you are in the class.

After the claim deadline passes, the administrator processes all submitted claims, assigns them to tiers, and calculates individual payment amounts based on the total number of valid claims received. Payments are then mailed or deposited, depending on the method you chose when you filed.

What documentation to gather before you file

Before you submit your claim, collect anything that shows what you did in response to the breach. This includes credit monitoring receipts or billing statements, credit reports you pulled (with dates), bank statements showing you checked your accounts, correspondence with creditors or your bank about the breach, and any documentation of fraud or identity theft.

If you paid for credit monitoring specifically because of this breach, that is your strongest evidence for the higher tier. If you simply checked your credit report online for free or reviewed your bank statements, document the dates and how much time you spent. If you experienced fraud, gather police reports, credit card statements showing unauthorized charges, letters from creditors about accounts you did not open, and any correspondence with your bank or credit card company about the fraud.

Do not submit original documents. Make copies and keep the originals. The settlement administrator does not return documents, and you may need them for your own records or for other purposes like filing a police report or disputing fraud with a creditor.

Tax implications of the settlement payment

Settlement payments for data breaches are generally not taxable income, because they are considered compensation for harm rather than income you earned. However, tax law can be complex, and your specific situation may differ. The settlement administrator will send you a tax form (usually a 1099 or a letter explaining the tax treatment) after payment is made.

Keep that form and any documentation the administrator sends about the tax status of your payment. If you have questions about whether the payment is taxable in your situation, consult a tax professional or contact the IRS directly. Do not assume the payment is tax-free just because it is a settlement; confirm it with someone who understands your tax situation.

Frequently Asked Questions

What if I never received the settlement notice in the mail?

Contact the settlement administrator directly using the case name and number to confirm whether you are in the class and to ask about the claim deadline. If the deadline has not passed, you can still file. If it has passed, you may be out of luck, but some administrators have procedures for late claims if you can show the notice never reached you.

Do I have to accept the settlement payment, or can I opt out and sue Infosys myself?

You can opt out of the settlement if you do so before the deadline, which is usually stated in the settlement notice. If you opt out, you keep the right to sue Infosys separately. However, individual lawsuits over data breaches are expensive and difficult to win, and most people who opt out end up with nothing. The settlement payment is usually the better option.

How long does it take to receive the payment after I submit my claim?

The administrator typically processes claims for several months after the deadline, then calculates payments and sends them out. The entire process usually takes four to eight months from the claim deadline to payment. You will receive a notice telling you when to expect your payment and how it will be delivered.

What if my claim is denied or I disagree with the tier I was assigned?

The settlement notice includes information about how to object to a claim decision. You can submit additional documentation or a written objection explaining why you believe your claim should be approved or moved to a higher tier. The administrator will review your objection, but the decision is final and cannot be appealed to a court.

Do I have to report this payment to any government agency?

Settlement payments are generally not reported to government agencies unless they are determined to be taxable income, in which case you report them on your tax return. If you receive means-tested benefits like Supplemental Security Income or SNAP, check with your benefits administrator about whether the settlement payment affects your benefits, as some programs count settlement money as income or assets.