The Infosys McCamish breach exposed personal data from millions of people, and affected individuals can receive settlement money through a claims process

In 2021, Infosys discovered that its subsidiary McCamish Global Services had suffered a data breach affecting approximately 3.2 million people. The breach exposed names, Social Security numbers, dates of birth, and financial account information. Infosys and McCamish settled a class action lawsuit, and the settlement fund now pays out to people whose data was compromised. Unlike government benefits, this is a private settlement — the money comes from the defendant's insurance and legal settlement, not from a government program.

The settlement does not require you to prove you suffered financial harm. Instead, it operates on a claims-made basis: you submit proof that your information was in the McCamish system, and if approved, you receive a payment. The amount varies depending on how many valid claims are filed, but the settlement fund is fixed. The more people who file, the smaller each individual payment becomes.

Key Takeaways

  • The settlement covers people whose personal information was exposed in the 2021 McCamish data breach, regardless of whether they suffered actual financial loss.
  • You must submit a claim with proof of your connection to McCamish — typically a document showing you had a policy, account, or relationship with the company.
  • Payment amounts are not fixed; they depend on the total number of valid claims filed against the settlement fund.
  • The claims important date has passed for most people, though some individuals may still have limited time to file depending on when they were notified.
  • Settlement payments are typically sent by check or electronic transfer once your claim is processed and approved.

Who is covered by the settlement

The settlement covers anyone whose personal information was stored in McCamish's systems during the time of the breach. McCamish processes insurance policies and claims for life insurance, disability insurance, and long-term care insurance. If you held a policy with an insurer that used McCamish to administer claims or customer data, your information may have been exposed.

You do not need to have suffered identity theft or fraud to file a claim. The settlement assumes that exposure to this type of data creates risk, and compensates people for that risk regardless of whether they experienced actual financial harm. However, you do need to prove you were a McCamish customer or policyholder — the settlement administrator will not take your word for it.

What documents you need to file a claim

To file a claim, you must provide proof that your information was in McCamish's system. The most straightforward proof is a document showing you had a policy or account with an insurer that used McCamish. This could be a policy document, a benefits statement, a claim letter, or any official correspondence from an insurance company showing your name and policy number.

If you no longer have original documents, you can request copies from your insurance company or former employer's benefits department. Some people received direct notification letters from McCamish or the settlement administrator — these letters themselves count as proof. If you received a letter saying your data was affected, keep it; that is often sufficient to support your claim.

You will also need to provide your current contact information and, typically, your Social Security number or date of birth to verify your identity. The settlement administrator uses this information to confirm you match a record in the breached database.

How the claims process works and what to expect

Claims are filed through the settlement administrator's website or by mail. The administrator reviews your submission to confirm that your information matches records from the breach and that you submitted the required documentation. This review typically takes four to eight weeks, though processing times vary depending on the volume of claims received.

Once your claim is approved, you will receive notification of the payment amount. The settlement fund is divided equally among all approved claims, so your payment depends on how many other people file. If 100,000 claims are filed against a $10 million fund, each payment would be approximately $100 — but if 500,000 claims are filed, each payment drops to $20. The settlement administrator publishes periodic updates on the number of claims received, which gives you a rough idea of what your payment might be.

Payments are typically sent by check or direct deposit, depending on what you request during the claims process. Checks are mailed to the address you provide; direct deposit requires you to supply banking information. Some settlement administrators offer a third-party payment service if you prefer not to share bank details directly.

important date for filing your claim

The original claims important date for the McCamish settlement has passed for most people. However, the exact date depends on when you were notified of the breach. People who received notice by mail had a important date typically 90 to 120 days from the date on their notification letter. Some individuals may still be within the filing window if they were notified late or if a court extended the important date.

If you believe you were affected but never received a notification letter, contact the settlement administrator directly to ask about your status. They maintain records of who was notified and when. If you were never notified despite being in the breached database, you may still have time to file — the settlement administrator can tell you whether your important date has passed.

Do not wait if you think you are still within the important date. Settlement claims important date are strictly enforced, and missing the important date bars you from receiving any payment, even if your claim would otherwise be valid.

How settlement payments differ from insurance claims

A settlement payment is not the same as an insurance claim. When you file an insurance claim, you are asking the insurance company to pay for a specific loss — medical bills, disability income, a death benefit. The insurance company investigates whether the loss is covered under your policy and how much they owe.

A data breach settlement payment is different. You are not proving a specific loss. Instead, you are proving that your data was exposed, and the settlement compensates you for the risk and inconvenience of that exposure. The payment is the same for everyone whose claim is approved, divided equally by the number of approved claims. There is no investigation into whether you actually suffered harm.

This also means settlement payments are not taxable income in the way that other compensation might be. The IRS generally treats data breach settlement payments as reimbursement for a loss rather than income, though you should consult a tax professional about your specific situation.

What happens if your claim is denied

A claim can be denied if the settlement administrator cannot match your information to the breached database, if you do not provide required documentation, or if you miss the filing important date. If your claim is denied, you will receive a written explanation of why.

Most settlement administrators allow you to submit additional documentation or appeal a denial within a set period — usually 30 to 60 days. If you have other documents that prove your connection to McCamish, submit them with your appeal. If the administrator made an error in matching your information, provide clarification.

If your appeal is also denied, you may have the right to pursue the matter in court, though this is rare and typically not worth the cost for a settlement payment of this size. The settlement agreement itself includes information about any further appeal rights.

Frequently Asked Questions

Do I have to pay taxes on the settlement payment?

Data breach settlement payments are generally not taxable income because they are treated as reimbursement for a loss rather than compensation for services or income. However, tax law can be complex, and your specific situation may differ. Consult a tax professional or review IRS guidance on settlement payments to be certain.

What if I cannot find proof that I was a McCamish customer?

Contact your former insurance company or employer's benefits department and ask them to send you a copy of your policy or benefits statement. If you received a notification letter from McCamish or the settlement administrator, that letter itself is usually sufficient proof. If you have neither, call the settlement administrator and explain your situation — they may be able to verify your information another way.

Can I file a claim if I have already received identity theft protection services from Infosys?

Yes. Infosys offered free credit monitoring and identity theft protection to affected individuals, but that service is separate from the settlement payment. Receiving the free service does not prevent you from filing a claim for the settlement money.

How long does it take to receive my payment after my claim is approved?

Most settlement administrators mail checks within two to four weeks of approval. Direct deposit payments may arrive faster, sometimes within one to two weeks. Check the settlement administrator's website for current processing times, as they vary depending on claim volume.

What if I moved and the settlement check was returned to the administrator?

Contact the settlement administrator when ready with your new address. They typically hold uncashed checks for a set period — often one to two years — before returning the money to the settlement fund. If you reach out before that important date, they can reissue the check to your current address.