The information at issue is difficult to replace. Names can be changed in a database. Social Security numbers can follow people for life.

Hire Velocity, a recruitment and talent-acquisition firm, says it collects and stores personal information while serving employees and clients. According to its signed settlement agreement, a 2025 cyber incident disrupted access to some systems and may have exposed files containing names and Social Security numbers associated with certain employees, contractors, and clients.

The agreement does not identify how many people were notified. It also does not disclose whether the files were copied, who accessed them, how the attacker entered the network, or whether the information was later used for fraud. Those omissions make it impossible to measure the incident’s full scale from this record alone.

Three months from detection to notification

The settlement agreement lays out a sequence in which the company first detected disruption, later learned that files may have been accessed, and then mailed notices. The dates establish chronology, not what Hire Velocity knew before each point or whether any delay caused additional harm.

1. On or about February 17, 2025

   Hire Velocity became aware of suspicious activity that disrupted access to certain computer systems.

2. On or about April 15, 2025

   The company became aware that a third party may have unlawfully accessed files containing private information.

3. On or about May 16, 2025

   Hire Velocity began sending notification letters to people whose information may have been accessed.

4. May 23 and May 28, 2025

   Lencola Roberts and Celestino Sanchez II filed separate proposed class actions in federal court. The cases were consolidated, and Ginger Wagner joined as a named plaintiff.

5. December 11, 2025

   The parties say they reached agreement on the material settlement terms after negotiations and informal discovery.

6. February 23, 2026

   The plaintiffs, class counsel, Hire Velocity’s president and CEO, and defense counsel signed the settlement agreement after the case was refiled in Fulton County state court.

What the record establishes, and what it does not

The plaintiffs alleged negligence, negligence per se, breach of implied contract, unjust enrichment, breach of confidence, and entitlement to declaratory relief. A proposed final approval order describes their theory as a failure to implement or maintain adequate safeguards for private information.

Those are allegations, not findings. The supplied packet does not contain the underlying complaint’s factual detail, an expert report, a forensic investigation, or a judicial decision on whether Hire Velocity’s security was legally inadequate.

Hire Velocity says it agreed to settle to avoid the cost, burden, distraction, and uncertainty of further litigation. The agreement expressly states that it is not an admission of liability. It also says class counsel believes the claims have merit and considers the settlement fair in light of litigation risks.

The settlement turns exposure into a claims process

The proposed class covers living people in the United States who received written notice from Hire Velocity that their private information may have been compromised in the February 2025 incident. Company directors and officers, government entities, assigned court personnel, and people who validly opt out are excluded.

A person seeking loss reimbursement would have to attest under penalty of perjury and submit reasonable supporting records. The agreement lists receipts, telephone records, emails, and other correspondence as examples. A personal statement alone would not count as adequate documentation, although it could explain other records.

The claims administrator could seek more information, reduce a claim, or deny it. Under the proposed terms, the administrator’s final decision on approval, reduction, or denial would be binding. Duplicate, late, incomplete, illegible, or apparently fraudulent claims could be rejected.

The agreement includes one safeguard against extremely low participation. If fewer than 2 percent of class members have filed claims 30 days before the claim deadline, reminder notices must be mailed to people who have neither opted out nor submitted a claim.

Doing nothing would still surrender claims

The most consequential term is not the $40 payment. It is the release.

If the settlement receives final approval and becomes effective, class members who do not opt out would release Hire Velocity and a wide group of related parties from known and unknown claims arising from the incident. That release would apply even to a person who files no claim and receives neither cash nor monitoring.

The finalized court-approved notice, if one is issued, will control the actual procedures and deadlines. The supplied drafts still contain placeholders for the website, mailing address, hearing date, claim deadline, opt-out deadline, and objection deadline.

No class size and no aggregate price tag

The agreement does not establish a fixed common settlement fund or state an overall cap on valid class-member benefits. Instead, Hire Velocity agrees to pay approved claims, monitoring, administration costs, court-approved fees, and service awards.

That structure avoids an obvious pro rata reduction in the disclosed terms, but it also means the packet provides no usable estimate of the settlement’s total consumer value. That figure depends on facts not supplied here: the number of notified people, participation rate, mix of $40 and documented-loss claims, approved loss amounts, and monitoring enrollment.

Class counsel plans to request $185,000 in attorneys’ fees and costs. The three named plaintiffs may each seek a service award of up to $4,000. Hire Velocity agreed not to oppose requests up to those amounts, and the agreement says those items were negotiated after the material settlement terms. All remain subject to court approval.

Security improvements remain outside public view

The agreement says Hire Velocity will provide class counsel with a confidential declaration describing information-security enhancements implemented after the incident and their estimated annual costs, if applicable, before final approval.

That promise does not tell affected people what changed. The packet does not identify new controls, audit results, retention changes, access restrictions, testing requirements, or an outside security monitor. Because the declaration is designated confidential, the disclosed agreement does not give the public a way to compare the company’s earlier protections with its promised improvements.

This matters because cash addresses only part of the risk. When Social Security numbers may have been accessed, the durability of the information makes future protection and detection central to evaluating whether a settlement provides meaningful relief. The record does not establish that identity theft occurred, but it also does not provide technical evidence that would define how the potential exposure was contained.

The court has not spoken in the supplied record

The packet includes proposed preliminary and final approval orders, but both are templates. Dates, hearing information, claim totals, opt-out totals, objection totals, fee awards, and the judge’s signature are blank.

A signed settlement agreement shows what the parties want the court to approve. It is not itself a finding that Hire Velocity did something wrong, that the proposed benefits are adequate, or that the class should be certified. Those determinations belong to the court.

The unresolved bargain

The proposed deal offers a simple choice to people who can prove no specific financial loss: claim $40 and monitoring, or preserve individual claims by opting out. People with records of incident-related expenses could seek more, but only through a documentation and review process controlled by the administrator.

In exchange, Hire Velocity would receive broad closure over claims tied to the incident. Whether that bargain is fair depends partly on numbers and security details the supplied agreement does not reveal. Until a court signs an approval order and the placeholders become real dates, the deal remains a proposal rather than a completed remedy.