Judge Denies Approval of $2.3M OE Federal Breach Settlement

A federal judge in California denied preliminary approval of a proposed $2.3 million class settlement over OE Federal Credit Union's 2023 ransomware breach, faulting a claims process the court called unnecessary and an estimated payout the order recalculates at "a little over $6" per person.

Information last verified on September 24, 2026. This is a developing story; we update it as the record changes.

Status: Preliminary approval was denied on September 16, 2026. There is no approved settlement, no claim form and no claim deadline. A revised motion is due November 4, 2026.

Jurisdiction scope: This is a single federal case in the U.S. District Court for the Northern District of California, brought on behalf of United States residents whose information was compromised in the OE Federal incident. The procedural rule the court applied, Federal Rule of Civil Procedure 23(e), governs every proposed class settlement in every federal district court. State courts apply their own class-action rules, which often resemble Rule 23 but are not identical.

What Happened

Daniel Jimenez Jr., Mark Hendren and Erica Jaramillo are current or former customers of OE Federal Credit Union, described in the amended complaint as "the country's largest labor-based credit union." According to the order, the credit union held customer personally identifiable information and protected health information including full names, Social Security numbers, dates of birth, bank and financial account information, Taxpayer Identification Numbers, driver's license numbers, usernames and passwords, passport numbers, and medical and health insurance information (Order at 1).

OE Federal suffered a ransomware attack and data breach "sometime between August 19, 2023 and October 29, 2023," and discovered the incident in October 2023 (Order at 1, 3). The plaintiffs sued in May 2024, alleging negligence, breach of implied contract, invasion of privacy, unjust enrichment, and violations of the California Unfair Competition Law, the California Consumer Privacy Act and the California Customer Records Act, plus declaratory relief. The credit union moved to dismiss; the court granted that motion in part and denied it in part, dismissing the implied-contract claim, the UCL claims and one CCRA claim with leave to amend, and the declaratory relief claim with prejudice (Order at 2).

The parties filed a joint notice of settlement in August 2025 and plaintiffs moved for preliminary approval. Under the proposal, OE Federal would fund a non-reversionary $2,300,000 settlement. Class members could submit a claim of up to $5,000 for documented out-of-pocket losses traceable to the incident, plus a pro rata cash payment the motion estimated at $50. California class members could claim an additional $75. Deducted from the gross fund would be $766,666.66 in attorney's fees, $5,000 service awards to each of the three named plaintiffs, and unspecified litigation and administration costs (Order at 3).

On September 16, 2026, the court denied the motion. The denial is without prejudice, so the case continues and the parties may file a corrected motion.

What the Court Found Wrong

The order is not a close call on a single issue. The court wrote that although "some of the factors lend support for finding that the settlement agreement falls within the range of possible approval, there are a number of obvious deficiencies that prevent the Court from granting preliminary approval at this time" (Order at 6). It then listed them.

1. A claims process the court found unnecessary. This is the lead problem and the most transferable one.

First, the settlement utilizes a claims-made distribution process when it appears unnecessary. When as here, the Defendants have a method to identify the class members and can readily do so, a claims-made settlement is inappropriate.

Order at 6

The court pointed to the settlement agreement's own definition of the "Settlement Class List," which requires OE Federal to hand the administrator "the full names and current or last known home addresses and email addresses for Settlement Class Members" within ten days of a preliminary approval order (Order at 6). If the defendant can address an envelope to every class member, the court reasoned, requiring those same people to fill out a form before they get paid mostly reduces what the defendant pays out. Quoting a leading treatise: "The effect of not simply distributing relief to the known class members is that the defendant will likely pay out much less than it would if there were no claiming process" (Order at 6).

2. No evidence of what the class could have won. Plaintiffs offered no figure for the maximum recovery if they had prevailed at trial. The order quotes prior decisions from the same court: without that denominator, "any fraction has a denominator, and without knowing what it is the Court cannot balance plaintiffs' expected recovery against the proposed settlement amount" (Order at 7). Counsel's supporting declaration said only that the settlement "is well within the range of other data breach settlements in the relief that it provides." The court called that "boilerplate language" and repeated the standard it applies: "Plaintiffs seeking preliminary approval should show their work by explaining the relative value of their claims in significant detail" (Order at 7).

3. Generic risk analysis. The motion described a "high level of risk, expense, and complexity" and "heavy obstacles and inherent risks" at class certification, summary judgment and trial. The court found those "generic statements about the risks inherent to a class action" insufficient, noting that a party moving for preliminary approval "should cite case law and apply it to explain why each claim or defense in the case is more or less likely to prove meritorious" (Order at 7 to 8).

4. The math on the per-person payment. The court did the arithmetic the motion had not.

Fourth, Plaintiffs' estimate that the pro rata settlement would provide a recovery of approximately $50 per class member is unsupported by any evidence and does not allow the Court to evaluate whether the settlement is fair. If the estimate is based on a low claims rate, that amplifies the Court's concerns about using a claims-made distribution process. Plaintiffs estimate the class to consist of over 220,000 individuals. ... After subtracting the proposed attorney fees, the estimated recovery per class member will be a little over $6. The total pool of funds for the pro rata distribution will be further reduced by settlement administration costs, incentive awards, and litigation costs. The pro rata share will also decline if any class members seek reimbursement of up to $5,000 of their out-of-pocket costs. In fact, if just over 300 Plaintiffs submit out-of-pocket reimbursement claims of $5,000, the pro rata share could dwindle to nothing for the remaining class members.

Order at 8

Note the structural point buried in that paragraph: a $50 per-person estimate against a fund that size only works if most people never claim. The estimate and the claims process were leaning on each other.

5. Unexplained preference for California class members. The proposal gave California class members an extra $75 with no California subclass and no different claims to justify it. The order quotes the Third Circuit: "One sign that a settlement may not be fair is that some segments of the class are treated differently from others" (Order at 8 to 9). It ties the point directly to Rule 23(e)(2)(D), which requires that a settlement proposal treat class members equitably relative to each other.

6. The motion misdescribed its own settlement. The court found that "the motion does not accurately summarize the settlement" (Order at 9). The motion said claims would be paid no later than seven days after final approval if no appeals were taken, or 14 days after the effective date, citing paragraph 12 of the agreement. Paragraph 12 does not address payment timing at all. Paragraph 56 does, and it says only that payments issue "as soon as practicable after the allocation and distribution of funds are determined." The court also observed that paying within 14 days of the effective date "seems unlikely," because a different paragraph gives OE Federal thirty days after the effective date just to establish the fund (Order at 9).

7. Noncompliance with the district's own class-settlement guidelines. The Northern District of California publishes Procedural Guidance for Class Action Settlements, and the order notes: "A movant's failure to address the issues discussed in the Guidelines is a proper ground for denying a motion for preliminary or final approval of a class action settlement." The motion skipped the guidance on potential full-prevail recovery, on how the settlement administrator was selected and what competing bids existed, and on comparable prior settlements, including claim rates and administrative costs (Order at 10).

The order closes with an observation rather than a ruling: counsel anticipates seeking up to one third of the fund in fees, and the court reminded the parties that "[f]or more than two decades, the Ninth Circuit has set the 'benchmark for an attorneys' fee award in a successful class action [at] twenty-five percent of the entire common fund,'" and that any deviation should be justified (Order at 10 to 11).

What the Law Actually Says

Preliminary approval is often treated as a formality. Rule 23 does not describe it that way.

Federal Rule of Civil Procedure 23(e) provides that class claims "may be settled, voluntarily dismissed, or compromised only with the court's approval." The first gate is Rule 23(e)(1)(B), which conditions even sending notice to the class on the parties' showing:

The court must direct notice in a reasonable manner to all class members who would be bound by the proposal if giving notice is justified by the parties' showing that the court will likely be able to: (i) approve the proposal under Rule 23(e)(2); and (ii) certify the class for purposes of judgment on the proposal.

Fed. R. Civ. P. 23(e)(1)(B)

That is a forward-looking prediction, and the burden sits on the parties proposing the settlement. If they cannot make the showing, notice does not go out and the class never sees a claim form.

The second gate, Rule 23(e)(2), is the substantive one. A court may approve a binding proposal "only after a hearing and only on finding that it is fair, reasonable, and adequate," considering whether:

(A) the class representatives and class counsel have adequately represented the class; (B) the proposal was negotiated at arm's length; (C) the relief provided for the class is adequate, taking into account: (i) the costs, risks, and delay of trial and appeal; (ii) the effectiveness of any proposed method of distributing relief to the class, including the method of processing class-member claims; (iii) the terms of any proposed award of attorney's fees, including timing of payment; and (iv) any agreement required to be identified under Rule 23(e)(3); and (D) the proposal treats class members equitably relative to each other.

Fed. R. Civ. P. 23(e)(2)

Read that list against the seven defects and the fit is exact. The claims-process finding is 23(e)(2)(C)(ii), the effectiveness of the distribution method "including the method of processing class-member claims." The missing maximum-recovery evidence and the thin risk analysis go to 23(e)(2)(C)(i). The fee arithmetic is 23(e)(2)(C)(iii). The California bonus is 23(e)(2)(D). The court is not improvising a standard here; it is walking the rule.

One further constraint explains why the court denied the motion rather than trimming the parts it disliked. Under Ninth Circuit law the settlement "must stand or fall in its entirety," because courts lack the ability to "delete, modify, or substitute certain provisions" (Order at 5). A judge who finds one term unfair has to send the whole package back.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

Most people meet the class-settlement system exactly once, when a postcard arrives saying their data was exposed and they may be entitled to a payment. There is rarely a way to tell a strong deal from a weak one. This order is unusually useful because it is a judge doing that evaluation out loud, in plain arithmetic, on a document any reader can obtain.

Four questions from this order travel to almost any class settlement notice:

Does the defendant already know who you are, and are they still making you file a form? The court's first and most emphatic finding was that a claims process is hard to justify when the defendant can produce every class member's name, mailing address and email address on ten days' notice. Data breach cases are the clearest example of this, because the company had to identify and notify everyone to comply with breach-notification law in the first place. A claim form in that setting is a filter, and filters reduce payouts. That does not make every claims-made settlement improper, and the order acknowledges that such a process is sometimes the only workable option. It does mean the parties owe the court a reason.

What is the headline number after fees? The motion advertised roughly $50. The court's own calculation produced a little over $6 before administration costs, service awards and litigation costs come out. The gap was not a hidden term; it was division. A $2.3 million fund minus $766,666.66 in requested fees, spread across more than 220,000 people, cannot produce $50 each unless most of those people never claim. Any notice that quotes an estimated per-person payment is quoting an assumption about how few of your fellow class members will bother.

Can a small number of large claims consume the fund? The order flags that just over 300 maximum out-of-pocket claims could leave the pro rata share at nothing. This is a common architecture in breach settlements: a documented-loss tier sitting on top of a flat-payment tier, both drawing from one pot. Whether the flat payment survives depends on facts nobody knows at notice time.

Are some class members being paid more, and is there a stated reason? The California uplift may well be defensible on a fuller record. The problem the court identified was that no reason was offered. Differential treatment is not automatically unfair, but it is a documented warning sign, and Rule 23(e)(2)(D) makes equitable treatment an express approval factor.

There is a fifth item worth noticing, aimed less at readers than at the practice. The court found that the motion described its own settlement's payment-timing terms incorrectly and cited a paragraph that says nothing about payment timing. That is a drafting failure in a document whose entire function is to persuade a judge that absent class members are protected. It is also the kind of error only close reading catches, which is the argument for the close reading.

None of this tells anyone whether the revised motion will succeed, and we take no position on that. The value here is the checklist. If a class-settlement notice arrives in your mail, the productive questions are: what is the per-person number after fees, who decided you have to apply for it, what happens to your share if other people claim more, and is anyone being paid differently than you for reasons nobody has explained. If you are trying to reduce exposure from a breach in the meantime, that is a separate track from any settlement, and the practical starting points are a credit freeze rather than a fraud alert and, if misuse has already occurred, the federal identity theft reporting process. A freeze is free and does not depend on any court.

What Happens Next

The motion was denied without prejudice, which means the case remains open and the plaintiffs may file a corrected motion. The order sets one date: "A revised motion for preliminary approval is due November 4, 2026" (Order at 11).

Until a revised motion is filed and granted, the procedural posture is unchanged from a class member's perspective. No notice has been authorized, no claims administrator has been appointed, no claim period has opened and no fairness hearing has been scheduled. The order also declined to rule on attorney's fees, noting that the court "will not determine appropriate fees until after a motion has been filed" (Order at 10 to 11).

We are tracking the docket and will update this article when the revised motion, or any order on it, is entered. Our broader index of pending and closed consumer matters is at the data breach settlement tracker.

This article is general legal information, not legal advice. It does not create an attorney-client relationship and it does not describe any claim, benefit or deadline available to you. No settlement has been approved in this case and nothing here should be read as a statement that you are eligible for anything. For advice about your own situation, consult a licensed attorney in your jurisdiction.

Related articles

• Open and closed consumer class settlements we track
• Freezing your credit versus placing a fraud alert
• Reporting identity theft to the FTC and building a recovery plan
• Are class action settlement payments taxable?

Last updated: 2026-09-24. This is a developing story; details verified as of 2026-09-24.

Frequently Asked Questions

Can I file a claim?

No. There is no claim to file. The court denied preliminary approval on September 16, 2026, which means no notice program was authorized, no claims administrator was appointed and no claim form exists. Nothing can be submitted, and no money is available to anyone. If a website invites you to file an OE Federal claim, it does not reflect the court record, and you should not enter personal information there.

Is there a deadline I need to worry about?

There is no deadline for class members. The only date in the order is a deadline for the lawyers: a revised motion for preliminary approval is due November 4, 2026. That is a filing deadline for the parties, not a claim deadline, and it has no effect on anyone who is not litigating the case.

Does the denial mean the case is over?

No. The motion was denied without prejudice, so the parties may correct the problems identified in the order and file a revised motion. The lawsuit itself continues. We do not predict whether a revised settlement will be approved.

What is the difference between preliminary and final approval?

Preliminary approval is the first of two gates under Rule 23(e). Under Rule 23(e)(1)(B), a court sends notice to the class only if the parties show the court will likely be able to approve the settlement and certify the class. If that happens, class members receive notice and a period to claim, opt out or object, and the court then holds a hearing before deciding at final approval whether the settlement is fair, reasonable and adequate under Rule 23(e)(2). This case did not clear the first gate.

Why did the court object to a claim form?

Because OE Federal can already identify every class member. The settlement agreement requires the credit union to give the administrator the full names, home addresses and email addresses of class members within ten days of a preliminary approval order. The court found that requiring those same people to submit a form before being paid mostly reduces how much the defendant pays out, and that a claims-made process needs a justification when direct distribution is available.

Where did the $50 estimate go?

The motion estimated a pro rata payment of about $50. The order recalculated it, noting that after subtracting the proposed attorney fees from the $2.3 million fund across a class the plaintiffs estimate at more than 220,000 people, the estimated per-person recovery would be a little over $6, before administration costs, service awards and litigation costs are deducted. The court also noted the share could fall to nothing if just over 300 people submit the maximum $5,000 out-of-pocket claim.

Was anyone's data actually exposed?

The order describes the underlying incident as a ransomware attack and data breach occurring between August 19 and October 29, 2023, discovered in October 2023, involving categories of data that include Social Security numbers, financial account information and health information. Whether any particular person was affected is determined by the breach notice that person received from OE Federal, not by this order. If you believe your information was exposed, protective steps such as a credit freeze are available regardless of what happens in this case.

If a settlement is eventually approved and pays out, is the money taxable?

That depends on what the payment compensates and is a question for a tax professional, not something this order addresses. We cover the general framework in our explainer on [how class action settlement payments are treated for tax purposes](/us-laws/data-breach-settlements/are-class-action-settlements-taxable/). Nothing is payable in this case at present.