A single data breach can shake a company's finances. Two, spaced years apart, can compound into something far more consequential. Americold Logistics LLC has agreed to pay $5.25 million to settle a pair of proposed class actions alleging that lax cybersecurity at the cold storage giant led to two separate data breaches, together impacting nearly 225,000 workers across the country.

What Class Members Stand to Receive

Under the settlement, class members will be eligible for up to $25,000 in reimbursement for out-of-pocket costs directly tied to the breaches. Beyond that, those affected by just one breach can expect a residual cash payment of roughly $100, while individuals impacted by both breaches are eligible for a $200 residual payment, according to a motion filed Wednesday seeking final settlement approval — a tiered structure that scales compensation to the scope of exposure each person actually faced.

Who Qualifies for the Settlement

According to the motion, class members include everyone in the United States who was notified by Americold that their private information had been compromised in data breaches occurring in November 2020 and April 2023 — two separate incidents now being resolved together under a single settlement umbrella.

The Path Toward Settlement

This motion follows a notification submitted to the court back in March, confirming that an agreement had been reached to settle two related lawsuits — one filed against Americold in 2021 and another in 2023, each addressing a distinct data breach. U.S. District Judge Thomas W. Thrash Jr. granted preliminary approval of the deal in June, according to court records, setting the stage for this week's push toward final approval.

The First Breach and Its Aftermath

The earlier of the two cases was brought by Sean Sheffler, an Ohio resident and former Americold employee, who alleged the company failed to implement adequate cybersecurity measures that could have protected current and former employees during the November 2020 data breach.

A Second, Larger Breach Follows

The second lawsuit came from Lamont Bracy, an Alabama resident, who alleged that Americold failed to protect the personal information of more than 129,000 customers, current and former employees, and other consumers during a subsequent April 2023 data breach — a considerably larger incident that compounded the company's existing legal exposure.

The Legal Teams Behind the Settlement

The plaintiffs are represented by MaryBeth V. Gibson of the Gibson Consumer Law Group LLC, Terence R. Coates of Markovits Stock & Demarco LLC, Gary M. Klinger of Milberg Coleman Bryson Phillips Grossman PLLC, and John A. Yanchunis of Morgan & Morgan PA.

Americold is represented by Kristine M. Brown, Gavin Reinke, M. Ashley Miller and Nicole A. Weeks of Alston & Bird LLP.

For the nearly 225,000 workers and consumers caught up in these two separate breaches, this settlement offers a financial resolution to years of uncertainty — though it also stands as a pointed reminder that when cybersecurity gaps go unaddressed once, they have a troubling tendency to resurface again down the line.