$6.8M+ Paradies Shops Settlement Resolves Data Breach Lawsuit Over October 2020 Cyberattack

New to ClassAction.org? Read our Newswire Disclaimer

The Paradies Shops, LLC has agreed to pay more than $6.8 million to settle a class action lawsuit that alleged the airport retail company failed to protect current and former employees’ private information during an October 2020 data breach.

Don’t miss the next class action settlement deadline. Sign up for ClassAction.org’s free weekly newsletter.

The Paradies Shops data breach settlement, which received preliminary court approval on April 14, 2025, covers all United States residents to whom Paradies, through its vendor, Epiq, sent notice of the cyberattack. The deal covers approximately 72,376 people, according to the settlement agreement.

To receive certain benefits from the $6,875,720 Paradies Shops class action settlement, eligible class members must submit a claim form by mail or online through the court-approved website once it is established.

ClassAction.org will update this page when the official Paradies Shops settlement website is launched.

Court documents share that class members who file a timely, valid claim form will be eligible to receive up to $1,000 per person in compensation for documented “ordinary” out-of-pocket expenses that are reasonably linked to the data breach and were incurred between October 8, 2020 and the claim submission deadline.

Per the agreement, these costs must be unreimbursed and may include fees associated with credit reports, credit monitoring expenses, phone charges, postage or mileage costs, and other miscellaneous losses.

Class members may also submit a claim form to receive reimbursement for up to five hours of time spent responding to issues linked to the incident, at a rate of $30 per hour, subject to the $1,000 cap. This benefit is referred to as “ordinary” attested time.

In addition, the agreement relays that consumers who believe they have suffered identity theft, fraud or other serious losses that are “fairly traceable” to the cyberattack may file a claim for documented “extraordinary” expenses, up to $25,000 per person. According to the document, these losses must be unreimbursed and must have been incurred since October 8, 2020 as a result of the possible misuse of personal data.

Moreover, class members can submit a claim form to receive reimbursement for “extraordinary” attested time. This benefit provides consumers with compensation for up to 10 hours of time spent remedying identity theft, fraud or other data misuse related to the incident, at a rate of $30 per hour, the document explains.

Related Reading: The Paradies Shops Hit with Class Action Over Oct. 2020 Data Breach Affecting 76K Workers

Class members affected by the Paradies Shops data breach may also elect to enroll in three years of identity theft protection and credit monitoring services at no cost. This benefit is available to all consumers regardless of whether they submit a claim for any above-mentioned Paradies Shops settlement payouts, court records relay.

The settlement agreement notes that payments and credit monitoring benefits will be decreased on a pro rata basis as needed. Should funds remain after payment of these benefits, class members will automatically receive a pro-rated cash payout by mail, the document states. Consumers will not need to submit a claim form to receive this payment.

Lastly, as part of the deal, Paradies Shops has agreed to implement changes to its business practices in response to the data breach.

The court will decide whether to grant final approval to the settlement at a hearing set for July 24, 2025.

According to the court’s preliminary approval order, settlement notices will be issued 30 days after April 14, 2025, and class members will have 90 days from the date of mailing to submit a claim form.

The Paradies Shops class action lawsuit alleged that the company—which operates retail stores, restaurants and bars in more than 100 airports across the United States and Canada—failed to properly safeguard employees’ data when cybercriminals gained unauthorized access to its internal administrative system from October 8 to 13, 2020. The data breach lawsuit asserted that the cyberattack exposed workers’ names, Social Security numbers and other highly sensitive information.

Head to ClassAction.org’s settlements page for a complete list of data breach settlements.