Evolve Bank & Trust Data Breach Settlement: Paid in 2026
At a glance
- Status
- Paid out
- Defendant
- Evolve Bank & Trust
- Settlement fund
- $11,858,260
- Claim deadline
- October 30, 2025
- No-proof cash option
- Yes — Cash Payment B - Flat Cash: estimated $20.00 (no documentation); all Settlement Class Members may separately claim 1 year of credit monitoring (~$110/yr value, $1,000,000 identity-theft insurance) regardless of which cash option chosen, or up to Cash Payment A - Documented Losses: up to $3,000.00 upon presentment of reasonable documentation
- Max documented payout
- $3,000
- Administrator
- Kroll Settlement Administration LLC
- Official site
- www.evolvesettlement.com
- Court
- United States District Court for the Western District of Tennessee (Chief Judge Sheryl H. Lipman)
- Case number
- 2:24-md-03127-SHL-cgc, No. 2:24-md-03127-SHL-cgc
Last verified July 16, 2026
Key dates
| Milestone | Date | What it means |
|---|---|---|
| Claim deadline | October 30, 2025(passed) | Last day to file for a payment |
| Opt-out (exclusion) deadline | October 15, 2025(passed) | Last day to leave the settlement and keep the right to sue |
| Objection deadline | October 15, 2025(passed) | Last day to object to the terms |
| Final approval hearing | November 14, 2025(passed) | When the judge decides whether to approve the settlement |
| Expected payout | March 30, 2026(passed) | Payments are not sent until after final approval and any appeals |
Where to file
Evolve Bank & Trust Data Breach Settlement is administered by Kroll Settlement Administration LLC. The only place to file is the official settlement website:
Verify on the official sitewww.evolvesettlement.com
Filing is free. No legitimate settlement charges a fee to file a claim.
You cannot file on RecordingLaw.com. We are an independent publisher, not the settlement administrator, and we are not affiliated with any court, agency, or defendant.
As of July 2026, the Evolve Bank & Trust data breach settlement is paid. The court entered its Final Approval Order on December 15, 2025, and the administrator issued payments for every approved claim on March 30, 2026. If you filed a claim, that check or payment already went out.
If you have not cashed a paper check yet, do it soon. The official settlement site states that any uncashed check becomes void after September 28, 2026.
Why You Might Not Recognize This Company
Evolve Bank & Trust is a small, Arkansas-chartered bank, and most people affected by this settlement never opened an account with it directly. Evolve operates as a "banking as a service" bank, supplying accounts and card infrastructure behind a long list of consumer fintech apps. If you used Affirm's card product, used Wise, or used another fintech app that routes deposits through a partner bank, your data could have passed through Evolve's systems even though you have never heard the name.
That is why this settlement generates so many confused searches. People remember a notice from "Evolve Bank & Trust" with no memory of doing business with a company by that name, and wonder if it is a scam. It is not: the official class definition covers people affected directly or indirectly, including via FinTech partners, which is the settlement's own language for this exact situation.
What Happened: The February and May 2024 Data Incident
Evolve says unauthorized activity in its systems, in two separate windows in February and May 2024, let attackers access and download files containing personal information, what the settlement calls the Data Incident. Evolve did not discover the intrusion right away; it first noticed some systems behaving abnormally in late May 2024 and only later determined it was a cyberattack, not a hardware problem.
Evolve's own breach notice, posted on its website, names the attacker directly: "This was a ransomware attack by the criminal organization, LockBit." That detail is worth noting, because the settlement's own court filings are more cautious and describe the intrusion only as the work of unspecified cybercriminals, without naming LockBit. Both things can be true. Evolve's public notice made the LockBit attribution; the litigation record did not need to repeat it to establish liability.
The exposed information included names, Social Security numbers, dates of birth, Evolve account numbers, and, for some people, ACH transaction details with bank routing and account numbers.
Where the Case Stood, Step by Step
The lawsuits against Evolve were consolidated into a single multidistrict litigation, MDL No. 2:24-md-03127-SHL-cgc, before Chief Judge Sheryl H. Lipman in the U.S. District Court for the Western District of Tennessee. The claim deadline, and the deadlines to exclude yourself from the class or object to the deal, fell between October 15 and October 30, 2025. The Final Approval Hearing was held November 14, 2025, and the judge signed the Final Approval Order on December 15, 2025.
The administrator, Kroll Settlement Administration LLC, then spent roughly three and a half months reviewing every claim before issuing payments on March 30, 2026. That gap between approval and an actual check is normal; it is the time it takes to validate hundreds of thousands of individual claims, not a sign anything went wrong.
Who Was in the Class
The settlement class is 17,880,046 individuals in the United States whose Private Information was included in the files affected by the February or May 2024 Data Incident, whether Evolve collected that information directly or received it through a FinTech partner. If Evolve, or a fintech app that banked through Evolve, sent you a breach notice referencing this incident, you were very likely in that class.
How Much People Actually Got
Before talking numbers, one correction is worth making. You may see this settlement described online as a "$3.78 million" deal. That figure is not the settlement fund. It is the separate award of attorneys' fees the court approved out of the larger fund. The actual common fund, confirmed from the court's Final Approval Order, is $11,858,259.98.
Out of that fund, every eligible claimant could choose one of two cash options. Cash Payment B needed no documentation and was an estimated flat $20. Cash Payment A was for documented losses tied to the breach, capped at up to $3,000, but that required real records, receipts, or fraud reports, and the cap is a ceiling almost nobody actually reaches.
Separately from either cash option, every class member who filed could also request one year of credit monitoring, worth an estimated $110, including real-time alerts and $1,000,000 in identity theft insurance coverage.
None of those figures were guaranteed. The actual per-person payment depends on how many of the 17.88 million class members filed valid claims; more claims means a smaller pro rata share for everyone. The official materials do not publish the final, post-distribution amount people actually received, so treat $20 and $3,000 as filing-time estimates, not confirmed payouts.
If You Have Not Cashed Your Check
Cash a paper check now if you have not already. The official settlement site states uncashed checks void after September 28, 2026, and there is no second check issued afterward.
If you filed a valid claim and believe you should have received a payment but never did, the official site, evolvesettlement.com, lists contact information for Kroll Settlement Administration LLC. That is the only legitimate place to ask about a missing payment; nobody legitimately connected to this settlement will call or text you asking for your Social Security number or bank details to "verify" a payment.
Protect Yourself Now, Whether or Not You Filed
The claim window is closed, but the exposure itself does not expire. Social Security numbers and account numbers stolen in 2024 can still be used to open new credit in your name years later.
The single strongest free step is a credit freeze at all three major bureaus: Equifax, Experian, and TransUnion. A freeze blocks anyone, including someone using your stolen Social Security number, from opening new credit in your name, and by federal law it is free to place, lift, and remove. Our guide to freezing your credit after a data breach walks through the steps at each bureau.
If you already see signs of misuse, unfamiliar accounts or hard inquiries, IdentityTheft.gov, the FTC's free recovery site, builds a personalized recovery plan and generates the letters you need at no cost.
After Your Free Credit Freeze and Settlement Monitoring
A free credit freeze is the strongest protection against someone opening new credit in your name; if you filed a claim, use the year of monitoring this settlement includes first. Once that free coverage runs out, Aura offers ongoing monitoring across your credit, Social Security number, and accounts in one place.
Compare Aura PlansAffiliate disclosure: if you sign up through this link we may earn a commission, at no extra cost to you. Learn more
More Open and Closed Settlements
If Evolve is not the only notice you got, our data breach settlement tracker lists the settlements we have verified, open and closed.
Frequently Asked Questions
Is the Evolve Bank & Trust data breach settlement still accepting claims?
No. As of July 2026, the claim window is closed. The deadline to file was October 30, 2025, and the Evolve Bank & Trust data breach settlement is not accepting new claims.
Did the Evolve Bank & Trust settlement actually pay out?
Yes. The court entered its Final Approval Order on December 15, 2025, and the settlement administrator issued payments for approved claims on March 30, 2026. As of July 2026, this settlement is paid.
How much money did the Evolve Bank & Trust settlement pay?
The estimated payment was a flat $20 with no documentation, or up to $3,000 for documented losses, plus a separate year of credit monitoring. These were pro rata estimates from a fixed fund, not guaranteed amounts, and the official materials do not publish the final per-person amount paid.
How big was the Evolve Bank & Trust settlement fund?
The fund is $11,858,259.98, confirmed from the court's Final Approval Order. A $3.78 million figure circulating online is not the fund; it is the separate attorneys' fee award approved out of that fund.
Am I in the Evolve Bank & Trust settlement class?
You may be if you are one of the 17,880,046 people whose information was affected by Evolve's February or May 2024 data incident, directly or through a FinTech partner. A notice from Evolve, or from a fintech app that banks through Evolve, is the clearest sign.
Why did I get an Evolve Bank & Trust notice when I have never banked with Evolve?
Evolve is a banking-as-a-service bank that supplies accounts and card infrastructure behind other companies' fintech apps, including Affirm, Wise, and Bilt. If one of those apps routed your data through Evolve, you can be part of this settlement without ever opening an Evolve account yourself.
Was the Evolve Bank & Trust breach caused by LockBit ransomware?
Evolve's own breach notice says so directly, describing it as 'a ransomware attack by the criminal organization, LockBit.' The settlement's own court filings are more cautious, describing the intrusion only as the work of unnamed cybercriminals.
I have a settlement check I have not cashed yet. What is the deadline?
Cash it before September 28, 2026. The official settlement site states any uncashed check becomes void after that date, and there is no second check issued after a check voids.
What should I do now that the claim window is closed?
Whether or not you filed a claim, place a free credit freeze at Equifax, Experian, and TransUnion, since the breach exposed Social Security numbers. If you already suspect identity theft, start a free recovery plan at IdentityTheft.gov.
How to tell a settlement notice is real
Check the case name, case number, and court against the official settlement site. Go to that site directly instead of clicking a link in an email or text. Nobody legitimate will call, text, or email out of the blue asking for your Social Security number, bank account, or card details, and nobody will charge you to file. Report anyone who does at ReportFraud.ftc.gov.
Informational only. Not legal, tax, or financial advice, and not affiliated with any settlement.
RecordingLaw.com is an independent legal-information publisher. We are not a law firm, not a settlement administrator, and not affiliated with, endorsed by, or acting on behalf of any court, government agency, defendant, or claims administrator described on this page. Reading this page does not create an attorney-client relationship.
We do not process claims and we never collect your claim information. You cannot file a claim on RecordingLaw.com. To file, opt out, object, or check your status, use only the official settlement administrator identified above. We link to it for your convenience.
Filing a legitimate claim is free. No legitimate settlement or administrator will charge you a fee to file, or ask for your Social Security number, bank, or card details by unsolicited call, text, or email. If someone does, it is likely a scam. Report it at ReportFraud.ftc.gov.
Deadlines, amounts, and approval status change and are set by the court. We verify against the official administrator and court records, but confirm the current details on the official site before acting. Nothing here guarantees eligibility, a payment, or any amount. Settlement payments may be taxable. See IRS Publication 4345. and consult a tax professional. For advice about your specific situation, consult a licensed attorney in your state. Affiliate disclosure.
Sources and References
- Case docket filing, In re: Evolve Bank & Trust Customer Data Security Breach Litigation, MDL No. 2:24-md-03127-SHL-cgc, U.S. District Court for the Western District of Tennessee(tnwd.uscourts.gov).gov
- IdentityTheft.gov, Federal Trade Commission(identitytheft.gov).gov
- Credit Freezes and Fraud Alerts, Consumer Advice, Federal Trade Commission(consumer.ftc.gov).gov
- In Re: Evolve Bank & Trust Customer Data Security Breach Litigation, official settlement site(evolvesettlement.com)
- Frequently Asked Questions, Evolve Bank & Trust Data Breach Settlement(evolvesettlement.com)
- Cybersecurity Incident, official breach notice, Evolve Bank & Trust(getevolved.com)
- Affirm says cardholders impacted by Evolve Bank data breach, BleepingComputer(bleepingcomputer.com)