Circle K Exposed Your Social Security Number To Hackers. The Settlement Costs Them Pocket Change.

The Non-Financial Ledger

Once your Social Security Number is in the hands of a threat actor, the exposure follows you for the rest of your life: fraudulent tax returns filed in your name, credit accounts opened without your knowledge, medical debt accumulated by someone impersonating you, background checks that come back wrong because someone else’s crimes are now attached to your identity.

The workers named in this lawsuit were not customers who chose to hand over sensitive data. They were employees. Gas Express required their Social Security numbers as a condition of employment, collected that data, stored it on company systems, and owed those workers a basic duty of care. The company’s own systems were compromised. The people who kept those stores running, who showed up for shifts at Circle K locations across the country, are now living with the consequences of that failure.

The breach happened on May 20, 2024. The workers were not told until January 13, 2025. For more than seven months, they had no idea their most sensitive personal identifier had been stolen. They could not freeze their credit. They could not monitor for fraudulent filings. They could not take any protective action at all because they did not know there was anything to protect against. That delay is not a technicality. It is time that a threat actor had to weaponize the stolen data while the workers remained completely in the dark.

The settlement’s answer to this is a two-year credit monitoring product from a single bureau and, if you can document your losses and submit paperwork before the fund runs out, up to $2,000. If you cannot document losses, the answer is fifty dollars. Fifty dollars for the permanent, irreversible loss of your Social Security number.

Legal Receipts

The settlement document speaks plainly. Here is what it says, verbatim.

“On or about May 20, 2024, a cyberattack occurred on [Defendant’s] computer systems. The files accessed by the threat actor included at least names and Social Security numbers of current and former employees. On January 13, 2025, Defendant began sending notice letters to class members.”

• This establishes the gap: May 20, 2024 to January 13, 2025 is approximately 238 days, nearly eight months, between the breach and the first notification to affected workers.
• The document confirms the specific data type stolen: Social Security numbers. This is the single most sensitive category of personal identifier in the U.S. financial and identity system.
• The phrase “at least names and Social Security numbers” leaves open the possibility that additional data types were compromised but are not specified in this agreement.

• Gas Express settles for money, forces workers to sign away all future claims, and walks away with a clean legal record. No admission. No acknowledgment. No accountability on the record.
• This is not unusual; it is standard. That is precisely the problem. The system is designed to let corporations buy silence without ever being forced to say what they did.

“In the event the number of Valid Claims for Documented Losses exceeds $45,000.00, no further Valid Claims for Cash Payment A — Documented Losses will be accepted.”

• This cap means the entire fund for workers who suffered real, documentable financial harm from this breach has a ceiling of $45,000, total, across all class members combined.
• At the maximum individual payout of $2,000 per claim, that fund is exhausted after just 22 approved claims. After claim number 23, the documented-loss window closes and every remaining worker is shunted to the $50 alternative.

“In the event the percentage of Valid Claims for Cash Payment B — Alternate Cash reaches 10% of Settlement Class Members, no further Valid Claims for Cash Payment B — Alternate Cash will be accepted.”

• The $50 flat payment is also capped. Once 10% of the class files a claim, that option closes too. Workers who submitted their forms after the cap is reached get nothing, despite being class members with valid exposure to the breach.
• The settlement creates a race-to-the-mailbox dynamic where the workers with the fastest access to legal information, stable addresses, and time to file paperwork receive compensation, while the workers who most need it, often lower-wage, more transient employees, may receive nothing at all.

“If a Settlement Class Member does not submit a Valid Claim or opt-out of the Settlement, the Settlement Class Member will release his or her claims against Defendant without receiving a Settlement Class Member Benefit.”

• This clause is the sharpest edge in the entire agreement. Workers who do nothing, who never receive the notice, who cannot navigate the claims process, who miss the deadline, all of them permanently surrender their legal rights against Circle K and every affiliated entity, receiving absolutely nothing in return.
• In class action settlements, this is called binding opt-out default. It is standard. It is also structured to maximize the number of people who give up their rights without ever knowing they had them.

Public Deception

The settlement documents reveal a structural gap between what Gas Express implied about its obligations and what actually occurred in the handling of the breach and its aftermath.

• What was implied: As a company that “collects, maintains, and stores information pertaining to current and former employees,” Gas Express held itself out as a custodian of worker data, a role that implies timely, responsible stewardship. The documented reality: Gas Express waited approximately 238 days after the breach before sending any notification to affected workers, during which time the threat actor had uncontested access to weaponize the stolen data.
• What was implied at settlement: The remedial measures and security enhancements Gas Express agreed to undertake are described as meaningful steps toward protecting worker data going forward. The documented reality: The details of those measures are kept in a confidential declaration shielded from public view, shared only with Class Counsel and the Court on request. Workers whose data was stolen have no way to know what, if anything, actually changed.
• What settling implies: Reaching a settlement implies some measure of responsibility was accepted. The documented reality: The agreement explicitly states Gas Express “expressly disclaims and denies any fault or liability” and that “nothing contained in this Agreement shall be used or construed as an admission of liability.”

Profit-Maximization at All Costs

The structure of this settlement reveals a corporation that calculated the cost of accountability and bought the minimum necessary to make the lawsuit disappear.

• The total documented-loss compensation fund is capped at $45,000. Once 22 workers collect the maximum $2,000 payout, the fund for real, documented identity-theft harm closes entirely.
• The flat cash alternative is $50. The total payout from all $50 claims is also capped at 10% of class members. Workers who file after either cap is reached receive nothing from the settlement.
• The credit monitoring product is also capped: once the total value of claims reaches $15,000, no more claims for monitoring are accepted. The product covers a single bureau, not all three. A threat actor with a worker’s SSN can open credit lines at institutions reporting to any of the three bureaus.
• Settlement administration costs are capped at $30,000. Class Counsel may collect up to $235,000 in fees and costs. The four named plaintiffs may receive $1,000 each ($4,000 total). Attorney fees alone could exceed every cent paid directly to affected workers.
• Gas Express agreed to pay for remedial security measures “separate and apart from other settlement benefits.” The dollar amount for those measures is not disclosed in the agreement. Workers have no way to assess whether the company spent meaningfully or minimally on the fix.

Societal Impact Mapping

Public Health and Safety

The exposure of Social Security numbers creates cascading risks that extend beyond immediate financial fraud.

• Medical identity theft, in which a threat actor uses a stolen SSN to obtain healthcare services or insurance benefits, can result in incorrect medical records attached to the victim’s identity, creating dangerous errors in future medical care.
• Workers who were not notified for 238 days had no ability to place fraud alerts, freeze their credit, or report potential misuse during that window. Any harm that materialized in that period was undetectable and unmitigable by the victim.
• The breach affected both current and former employees, meaning people who may have left Circle K years before the breach, who had no ongoing relationship with Gas Express and no reason to expect exposure, are now living with compromised identity data.

Economic Inequality

The financial structure of this settlement places its heaviest burdens on the workers least equipped to navigate it.

• Claiming the maximum $2,000 requires submitting documented evidence of out-of-pocket losses, navigating a formal claims process, meeting deadlines, and responding to deficiency notices within 15 days. Workers with limited internet access, unstable housing, or multiple jobs are structurally disadvantaged in that race.
• The $50 flat payment closes once 10% of class members have filed. Frontline convenience store workers, who are disproportionately lower-wage, less likely to receive legal news, and more likely to have moved addresses since their employment, will frequently miss that window.
• Workers who miss every deadline or fail to navigate the process release their legal rights without receiving any benefit at all. The default outcome for inaction is free legal immunity for Gas Express, not a neutral result for the worker.
• The single-bureau credit monitoring product offered is insufficient for comprehensive identity theft protection, yet the credit monitoring fund cap is only $15,000. Workers who need it most may find the fund already exhausted before they file.

Who Pays? Following the Cost

Gas Express transferred the cost of its data security failure outward to its workers and to the legal system, while retaining the benefit of a clean liability record.

• Workers absorbed the direct cost of the breach: time spent monitoring for fraud, stress and uncertainty during the 238-day notification gap, and any out-of-pocket losses from identity theft incidents traceable to the stolen data.
• Workers who cannot document losses are capped at $50 regardless of the actual scope of harm they experienced. The gap between documented and undocumented harm is a cost workers carry permanently.
• Class members who do nothing, either because they never received notice, cannot navigate the process, or simply do not know about the settlement, permanently forfeit their legal rights at no cost to Gas Express. Their inaction is the corporation’s windfall.
• The public court system bears the administrative cost of supervising the settlement, approving the class, overseeing the settlement administrator, and processing any objections, all funded by taxpayers rather than the corporation whose conduct caused the litigation.

The Settlement Isn’t Justice

Every structural element of this settlement is designed to resolve the corporation’s legal exposure at minimum cost, not to make harmed workers whole.

• Gas Express pays no admission of wrongdoing. The settlement agreement says explicitly it “shall not be offered or received in evidence in any action or proceeding in any court or other forum as an admission or concession of liability or wrongdoing of any nature.” The company buys legal silence, not accountability.
• The documented-loss fund cap of $45,000 is structurally inadequate for a breach affecting an unknown number of current and former employees. The settlement document does not disclose the size of the class, meaning the ratio of compensation to victims cannot be fully calculated from the source material. What is clear: 22 maximum payouts exhaust the fund entirely.
• Class Counsel may receive up to $235,000. The entire documented-loss compensation fund is $45,000. In the most straightforward reading of those numbers, the lawyers who brought the case stand to collect more than five times what the workers who suffered the breach can collectively receive for real, proven harm.
• The settlement explicitly states it was agreed to “without any admission of liability or wrongdoing.” Gas Express’s stated reason for settling is “to avoid the litigation costs and expenses, distractions, burden, expense, and disruption to its business operations.” The company is paying to make the problem disappear, not because it accepts it caused harm.
• Workers who do not receive notice, who cannot navigate the claims process, or who miss the deadline are permanently barred from suing Gas Express over this breach, in any court, in any jurisdiction, for any claim related to the incident. Their silence is treated as consent to release their rights.

The “Cost of a Life” Metric

This Is the System Working as Intended

Every outcome documented in this case, from the delayed notification to the no-admission settlement, followed the rules precisely. That is the indictment.

• The 238-day notification delay is a product of a notification framework that gives corporations significant flexibility in how quickly they disclose breaches. Gas Express did not break the law by waiting; it operated within it.
• The no-admission settlement is the standard outcome of class action data breach litigation. Corporations routinely settle without admitting fault because the system allows them to. Judges approve these settlements because they technically meet the legal standard of being “fair, adequate, and reasonable.”
• The caps on documented-loss claims and flat cash payments are enforceable and court-sanctioned. The court that approves this settlement will be endorsing a structure in which 23 workers with proven identity-theft losses get nothing from the fund.
• Workers who do nothing permanently release their rights under a system that treats silence as consent. This is the legal doctrine of opt-out class actions: participation is assumed, release is automatic, and the burden is on the individual worker to affirmatively claim exemption.
• The confidentiality of the remedial security measures declaration means the public cannot know whether Gas Express actually fixed its systems. The corporation improves its security posture (or does not) in private, while the workers whose data was stolen have no visibility into the outcome.