Cadence Bank $5.25M Settlement Over MOVEit Data Breach Exposing Customer PII

The lawsuit stems from the wider 2023 MOVEit incident, in which attackers exploited a vulnerability in Progress Software’s MOVEit Transfer file‑sharing tool—a product used by thousands of organizations to move large batches of sensitive data. Cadence Bank says the intrusion window ran roughly May 28–31, 2023, and notices went out around mid‑September to affected people; the settlement materials estimate about 869,411 individuals connected to the bank may have had personally identifying information (PII) exposed. Because MOVEit was a common vendor platform, the same underlying exploit rippled across industries, ultimately affecting thousands of public and private entities and tens of millions of individuals. Plaintiffs filed the case alleging Cadence failed to use reasonable data‑security practices and oversight, allowing customer PII to be put at risk through a third‑party system the bank relied on. Cadence denies wrongdoing but agreed to a $5.25 million settlement to avoid the cost and uncertainty of litigation, offering tiered reimbursements (up to $2,500 for documented out‑of‑pocket costs and up to $10,000 for documented extraordinary losses tied to the breach), an alternative pro‑rata cash payment for those without documented losses, and two years of credit monitoring and identity‑theft protection; it also committed to at least $3.5 million in security enhancements. The significance is less about a single payout and more about accountability: the case pressures financial institutions to treat vendor tools as part of their own security perimeter and to compensate customers not only for proven fraud but also for the time, fees, and protective steps people take after a breach. More broadly, Cadence’s agreement fits a growing pattern of MOVEit-related class actions where victims argue that organizations should have better safeguarded data in transit, limited what was stored or shared, and reacted faster once the vulnerability became public. In the U.S. banking context, regulators already expect robust cybersecurity and third‑party risk management—through frameworks like the Gramm‑Leach‑Bliley Act’s Safeguards Rule (as enforced by the FTC for covered institutions) and the federal banking agencies’ guidance on vendor oversight and incident response—and these cases reinforce that failing to manage vendors can carry real legal and financial consequences even when the initial flaw sits in a widely used software product.