Grayback Forestry Data Breach Class Action Settlement, $65 Cash or Up to $5,000, Plus 3 Years of Credit Monitoring

People who received a notice that their personal information may have been compromised in a January 2026 cyberattack on Grayback Forestry, Inc. may be eligible for benefits under a class action settlement. Eligible class members can choose either of the following:

• Up to $5,000 for documented out-of-pocket losses, which can include up to $125 for lost time (five hours at $25 per hour) counted inside the same $5,000 cap, or
• A $65 alternative cash payment with no receipts needed.

All class members can also enroll in three years of CyEx Financial Shield Complete credit monitoring with $1 million in financial fraud insurance.

Time-sensitive: The opt-out and objection deadline is November 27, 2026. The claim deadline is December 28, 2026. The final approval hearing is January 25, 2027.

Official settlement website: GraybackForestryDataSettlement.com | File your claim online: graybackforestrydatasettlement.com/form/claim

Grayback denies any wrongdoing, and the settlement remains subject to final court approval. No payment date has been announced.

Grayback Forestry Data Breach Settlement: Quick Facts

Detail	Information
Settlement name	Grayback Forestry Data Breach Settlement
Lawsuit	Mull v. Grayback Forestry, Inc.
Case number	26CV37687
Court	Josephine County Circuit Court, Oregon
Class representative	Michael Mull
Defendant	Grayback Forestry, Inc.
Data incident	January 2026 targeted cyberattack (files accessed between January 5 and 6, 2026)
Information potentially exposed	Names and Social Security numbers
Documented out-of-pocket losses	Up to $5,000 (proof required)
Lost-time compensation	Up to $125 (5 hours at $25), counts toward the $5,000 cap
Alternative cash payment	$65 (no proof required; cannot be combined with the options above)
Credit monitoring	3 years of CyEx Financial Shield Complete, with $1 million financial fraud insurance
Who can claim	All persons who received direct notice that their Private Information may have been compromised in the Data Breach
Claim form required?	Yes
Official settlement website	GraybackForestryDataSettlement.com
Online claim form	graybackforestrydatasettlement.com/form/claim
Notification mailing date	September 28, 2026
Opt-out deadline	November 27, 2026
Objection deadline	November 27, 2026
Claim deadline	December 28, 2026 (online, or paper claim postmarked)
Final approval hearing	January 25, 2027, at 9:00 a.m. Pacific Time
Settlement administrator	Simpluris
Administrator phone / email	(866) 675-2407 / [email protected]

What Happened in the Grayback Forestry Data Breach?

The lawsuit alleges that during a targeted cyberattack on Grayback Forestry’s computer systems in January 2026, unauthorized parties accessed certain files containing private information. Grayback Forestry is a wildfire suppression and forest restoration company based in Merlin, Oregon.

The files may have contained personal information such as names and Social Security numbers. The information involved may differ from person to person, so the settlement does not establish that every class member had both exposed. The incident has been reported to affect roughly 5,000 people, but that figure is not the eligibility test. Eligibility depends on whether you received direct notice.

Grayback denies the allegations and any wrongdoing. The court has not decided who is right. Both sides agreed to settle to avoid the cost and risk of a trial.

Who Qualifies for the Grayback Forestry Settlement?

The court defined the Settlement Class as:

“All Persons who received direct notice that their Private Information may have been compromised as a result of the Data Breach.”

You do not qualify automatically just because you live in Oregon, work in forestry, did business with Grayback or read about the breach. The key requirement is that you received direct notice from Grayback.

Excluded from the class:

1. Grayback and its officers, directors and related companies
2. The judge in the case, and the judge’s family and staff
3. Anyone who perpetrated the Data Breach
4. Anyone who validly excludes themselves from the settlement

What If I Did Not Get a Notice or Postcard?

Contact the administrator for free help checking whether you are a class member:

• Phone: (866) 675-2407
• Email: [email protected]
• Mail: Grayback Data Breach Settlement, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799-9958

Include your full name and mailing address.

Settlement Benefits: How Much Can You Get?

Benefit	Amount	Proof required?
Out-of-pocket expenses	Up to $5,000	Yes
Lost time	Up to $125 (within the $5,000 cap)	Time spent on breach-related tasks
Alternative Cash Payment	$65	No
Credit monitoring	3 years	No

Credit monitoring is available in addition to any cash option. If you claim the $65 Alternative Cash Payment, you cannot also receive out-of-pocket or lost-time compensation.

Option 1: Up to $5,000 for Documented Out-of-Pocket Losses

You can be reimbursed for actual, documented losses caused by the Data Breach that occurred between January 5, 2026, and December 28, 2026. Covered expenses include:

• Losses from identity theft or fraud
• Fees for credit reports
• Fees for credit monitoring
• Fees to freeze or unfreeze credit
• The cost to replace IDs
• Postage to contact banks by mail

To qualify, the loss must meet all four requirements:

1. It is an actual, documented, unreimbursed monetary loss.
2. It was more likely than not caused by the Data Breach.
3. It was incurred after the date of the Data Breach.
4. You made reasonable efforts to avoid the loss or to seek reimbursement for it, including from available credit monitoring insurance and identity theft insurance.

Proof: Submit a valid claim form with documentation such as bank statements or receipts showing how much you spent or lost. You can add notes or papers you prepared yourself to explain your proof, but self-prepared documents alone are not enough. You cannot claim expenses that a third party has already reimbursed. $5,000 is a maximum, not a guaranteed payment.

Related article: DotHouse Health Data Breach Class Action Settlement, $725,000 Fund, Up to $2,000 or an Estimated $40, Plus 2 Years of Credit Monitoring

Lost Time: Up to $125 (Counts Toward the $5,000 Cap)

If you spent time responding to the Data Breach, you may claim up to five hours at $25 per hour, for a maximum of $125. Qualifying tasks include changing passwords, investigating suspicious activity in your accounts and researching the Data Breach.

Time spent	Compensation
1 hour	$25
2 hours	$50
3 hours	$75
4 hours	$100
5 hours	$125

Important: Any lost-time payment counts toward the $5,000 out-of-pocket cap. It is not an extra $125 on top of $5,000.

Option 2: $65 Alternative Cash Payment

Instead of out-of-pocket or lost-time compensation, you may claim a one-time $65 Alternative Cash Payment. No documentation is required, but you must submit a valid Claim Form. If you claim this payment, you cannot also receive out-of-pocket or lost-time compensation.

Credit Monitoring: 3 Years of CyEx Financial Shield Complete

All class members are eligible to enroll in three years of CyEx Financial Shield Complete, which includes $1 million of financial fraud insurance and monitoring for:

• Fraud or identity theft
• Unauthorized financial transactions
• Personal information associated with high-risk transactions

If anything suspicious happens, you can speak with a fraud resolution agent. Enrollment codes were sent to class members by postcard. Your subscription becomes active only after the court grants Final Approval. If you no longer have your code, contact the administrator. The settlement website also offers an Enrollment Instruction Request form. The $1 million is insurance coverage, not a cash payment, and is subject to policy terms.

Is There a Total Settlement Fund?

The official FAQ does not state a single total fund amount. Grayback has agreed to pay the approved benefits, notice and administration costs, attorneys’ fees and costs, and any service award.

How Much Will the Lawyers Be Paid?

Class Counsel, Leanna A. Loginov of Shamis & Gentile, P.A., will ask the court to approve $90,000 in attorneys’ fees and litigation costs, plus a $2,000 service award for the class representative. Grayback pays these amounts, subject to court approval. You are not charged for Class Counsel’s services.

How to File a Grayback Forestry Settlement Claim

Option 1: File Online (Fastest)

1. Find your settlement notice and your LoginID and PIN.
2. Go to graybackforestrydatasettlement.com/form/claim.
3. Choose your cash option: out-of-pocket expenses and/or lost time, or the $65 Alternative Cash Payment.
4. If claiming losses, upload your supporting documents and list your lost time.
5. Submit by December 28, 2026 and save your confirmation.

Lost your LoginID or PIN? Email [email protected] with your full name and mailing address, or call (866) 675-2407.

Option 2: File by Mail

Download the printable Claim Form from the settlement website, complete and sign it, attach supporting documentation for any expense claim, and mail it to:

Grayback Data Breach Settlement c/o Settlement Administrator P.O. Box 25226 Santa Ana, CA 92799-9958

Mailed claims must be postmarked no later than December 28, 2026.

Important Grayback Forestry Settlement Deadlines

Event	Date
Notification mailing	September 28, 2026
Opt-out deadline	November 27, 2026
Objection deadline	November 27, 2026
Claim deadline	December 28, 2026
Final approval hearing	January 25, 2027, 9:00 a.m. PT

Your Legal Options: Claim, Opt Out, Object or Do Nothing

1. Submit a Claim

File a valid Claim Form by December 28, 2026 to receive benefits. If the court grants final approval, you will be bound by the settlement release.

2. Opt Out (Deadline: November 27, 2026)

If you opt out, you receive no settlement benefits, but you keep any right to sue Grayback on your own over the legal issues in this case. A valid Request for Exclusion must include:

1. The case name: Mull v. Grayback Forestry, Inc., Case No. 26CV37687, Josephine County Circuit Court, Oregon
2. Your full name, mailing address, telephone number and email address
3. Your personal signature
4. The words “Request for Exclusion” or a clear statement that you do not want to participate

Send it to Grayback Data Breach Settlement, ATTN: Exclusion Request, P.O. Box 25226, Santa Ana, CA 92799-9958. It must be postmarked or emailed by November 27, 2026. You may exclude only yourself.

3. Object (Deadline: November 27, 2026)

You may object only if you do not opt out. Your objection must include:

1. The case name and number
2. Your full name, mailing address, telephone number and email address
3. A clear description of all reasons for your objection, with any legal support
4. Your lawyer’s name, bar number and contact information, if you hired one
5. A list of any other objections you or your lawyer made in the past five years, with courts, orders and case numbers
6. Whether you or your lawyer want to speak at the Final Approval Hearing
7. A list of any witnesses or documents you plan to present
8. Your signature (or your lawyer’s signature, if you hired one)

File the complete objection with the Clerk of the Court, Josephine County Courthouse, Department 17, 500 NW 6th Street, Grants Pass, OR 97526-1975 by November 27, 2026, and send a copy to the Settlement Administrator (ATTN: Objections, at the P.O. Box above). Objecting is different from opting out. If you object, you stay in the class, and you can still file a claim.

4. Do Nothing

You receive no benefits and you give up the legal claims described in Section IX of the Settlement Agreement if final approval is granted.

Final Approval Hearing and Payment Timing

The court will hold the Final Approval Hearing on January 25, 2027, at 9:00 a.m. Pacific Time at the Josephine County Circuit Court in Oregon. The exact location will be set by the court, so check the official website for updates. The judge will decide whether to approve the settlement, how much to award Class Counsel and whether to grant the service award, and will consider any objections. You do not have to attend. The date and time may change without further notice.

When will payments arrive? No date has been announced. Benefits will be distributed only if the court grants final approval and after any appeals are resolved. Do not contact the court or the Clerk about the settlement. Contact the administrator instead.

What Happens If You Do Nothing?

You will receive no cash payment, no reimbursement, no lost-time compensation and no settlement credit monitoring. If the court grants final approval, you will also give up the right to join another lawsuit against Grayback over the issues the settlement covers. If you are thinking about suing on your own, the November 27, 2026 opt-out deadline is the one that matters.

Laws and Legal Rules Relevant to the Grayback Forestry Data Breach

The settlement does not publish a list of the original legal claims, and the court has made no finding that Grayback violated any specific law. The following is general background on the legal framework.

Oregon Consumer Information Protection Act (ORS 646A.600 to 646A.628)

Oregon’s Consumer Information Protection Act (OCIPA) regulates how covered businesses protect personal information and what they must do after a security breach. Personal information under the statute includes a person’s name combined with data such as a Social Security number, which is the kind of information identified in this case.

Breach Notification: ORS 646A.604

ORS 646A.604 generally requires a covered entity to notify affected Oregon consumers of a breach of security as soon as is practicable and no later than 45 days after discovering the breach or receiving notice of it, subject to statutory exceptions. It also requires the entity to take reasonable measures to determine the scope of the breach and restore the integrity, security and confidentiality of the data, and in larger breaches to notify the Oregon Attorney General. Timing disputes depend on the discovery date and the exceptions that apply. This settlement does not establish that Grayback violated the notification requirements.

Reasonable Safeguards: ORS 646A.622

ORS 646A.622 requires covered entities to develop, implement and maintain reasonable safeguards to protect the security, confidentiality and integrity of personal information, including when it is disposed of. Relevant questions in a breach case include whether access to sensitive records was properly controlled, whether systems were monitored and whether incident-response procedures existed. A cyberattack alone does not prove a violation.

No Private Right of Action Under OCIPA

The Oregon Department of Justice explains that OCIPA does not create a private right of action, and enforcement is by the Attorney General and other authorized state regulators. A private data breach class action therefore generally relies on other legal theories, such as negligence, breach of contract or other recognized claims, depending on the facts. The public settlement materials do not say which causes of action are being resolved, and this settlement is not a finding that Grayback violated OCIPA.

Oregon Unlawful Trade Practices Act (ORS 646.605 to 646.656)

The Unlawful Trade Practices Act (UTPA) prohibits specified unfair and deceptive practices in consumer transactions, and ORS 646.638 allows certain private actions for an ascertainable loss. Whether the UTPA applies to a data security incident depends on the nature of the transaction and conduct. The settlement is not a finding of a UTPA violation.

Oregon Class Action Rules (ORCP 32)

Class actions in Oregon state court are governed by Oregon Rule of Civil Procedure 32. A class settlement requires court approval after notice to class members, which is why the Final Approval Hearing must take place before any benefits are paid.

Federal Laws: FTC Act and Fair Credit Reporting Act

• FTC Act (15 U.S.C. § 45): Prohibits unfair or deceptive practices, which the FTC has applied to some data security failures. The settlement materials describe no FTC action against Grayback.
• Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.): Gives consumers the right to free annual credit reports and free credit freezes and fraud alerts.

Notification Laws vs. Private Lawsuits

A breach notification law says what a business must do after a qualifying incident. A civil lawsuit is different. A plaintiff must establish a recognized legal claim and prove its elements. This settlement resolves the case without any court finding that Grayback violated a particular statute.

Steps to Protect Yourself After a Data Breach

• Review bank, card and credit statements for unfamiliar activity.
• Check your free credit reports at AnnualCreditReport.com.
• Consider a free credit freeze with Equifax, Experian and TransUnion.
• Because Social Security numbers may be involved, consider an IRS Identity Protection PIN to help prevent tax-return fraud.
• Change passwords on important accounts and turn on multi-factor authentication.
• Report identity theft to the FTC at IdentityTheft.gov.
• Keep receipts and records of breach-related expenses and the time you spend, since you will need them for a documented-loss or lost-time claim.
• Be cautious of unexpected calls, texts or emails mentioning the breach. Claims are filed only through the official website or administrator.

Who Represents the Class?

The court-appointed Class Counsel is Leanna A. Loginov of Shamis & Gentile, P.A. The class representative is Michael Mull. You do not need your own lawyer to file a claim, but you may hire one at your own expense.

Related Data Breach Settlements

• Lowe Engineers Data Breach Settlement: $50 or Up to $5,500
• New York School of Interior Design Data Breach Settlement
• Sherr Puttmann Akins Lamb $455,000 Data Breach Settlement

These are separate cases with different defendants and eligibility rules. Qualifying for one does not qualify you for another.

Frequently Asked Questions

Is the Grayback Forestry data breach settlement real?

Yes. It is administered by Simpluris through the official website GraybackForestryDataSettlement.com. The case is Mull v. Grayback Forestry, Inc., Case No. 26CV37687, in Josephine County Circuit Court, Oregon.

How much money can I claim?

Up to $5,000 for documented out-of-pocket losses (including up to $125 for lost time within that cap), or a flat $65 with no proof. You can also enroll in three years of credit monitoring.

Can I get both $65 and $5,000?

No. The $65 payment is instead of out-of-pocket and lost-time compensation. Credit monitoring is available in addition to either.

Is the $125 for lost time extra?

No. It counts toward the $5,000 cap.

Do I need receipts to claim $65?

No, but you must submit a valid Claim Form.

Do I need proof to claim up to $5,000?

Yes. You need bank statements, receipts or similar documents showing the loss, and the loss must more likely than not have been caused by the Data Breach. Your own notes alone are not enough.

Who qualifies?

All persons who received direct notice that their Private Information may have been compromised in the Data Breach, subject to the exclusions.

How many people were affected?

Roughly 5,000 people have been reported as affected, but eligibility is based on receiving direct notice, not on that figure.

Does the settlement include free credit monitoring?

Yes. Three years of CyEx Financial Shield Complete with $1 million of financial fraud insurance. Your subscription becomes active after final approval.

What is the claim deadline?

December 28, 2026, for online claims and for mailed claims (postmarked).

What is the opt-out deadline?

November 27, 2026, postmarked or emailed.

What is the objection deadline?

November 27, 2026.

Has the settlement received final approval?

Not yet. The Final Approval Hearing is January 25, 2027.

When will payments arrive?

No date has been announced. Benefits are distributed after final approval and resolution of any appeals.

What happens if I do nothing?

You receive no benefits and you give up the claims covered by the settlement release.

Can a settlement payment affect my taxes?

Possibly. Tax treatment depends on your situation, so consult a qualified tax professional.

Legal Disclaimer

This article is for general informational purposes only and is not legal, tax or financial advice. The settlement remains subject to final court approval. The allegations have not been proven, and Grayback Forestry denies wrongdoing. Eligibility, benefits, legal rights and deadlines are governed by the official Notice of Class Action Settlement, Settlement Agreement and any later court orders. Dates and terms may change, so confirm all details on the official settlement website before acting. AllAboutLawyer.com is an independent legal information website, not a law firm, and does not represent any class member in this case. For advice about your own rights, including whether to opt out or object, consult a licensed attorney.

Sources

• Official Settlement Website: https://graybackforestrydatasettlement.com/
• Official FAQ: https://graybackforestrydatasettlement.com/faq/
• Important Dates: https://graybackforestrydatasettlement.com/dates/
• Online Claim Form: https://graybackforestrydatasettlement.com/form/claim
• Enrollment Instruction Request: https://graybackforestrydatasettlement.com/form/email-request/
• Notice of Class Action Settlement: https://cw.simpluris.com/docs/public/downloads/GMC1/NOTICE_OF_CLASS_ACTION_SETTLEMENT
• Settlement Agreement: https://cw.simpluris.com/docs/public/downloads/GMC1/SETTLEMENT_AGREEMENT
• Printable Claim Form: https://cw.simpluris.com/docs/public/downloads/GMC1/CLAIM_FORM
• Oregon Revised Statutes, Chapter 646A (OCIPA), including ORS 646A.604 and 646A.622: https://www.oregonlegislature.gov/bills_laws/ors/ors646a.html
• Oregon Department of Justice, Data Breaches: https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/data-breaches/
• Oregon Unlawful Trade Practices Act, ORS 646.605 to 646.656
• Oregon Rules of Civil Procedure, Rule 32 (Class Actions)
• Federal Trade Commission Act, 15 U.S.C. § 45
• Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq.