Settled, paying · closes September 3, 2026
Circle K data breach settlement with Gas Express, who is included and how to file
Last checked July 17, 2026
Canup et al. v. Gas Express LLC grew out of a targeted cyberattack in May 2024 on Gas Express, the company that operates Circle K-branded convenience stores. The lawsuit said the attackers got names, addresses, Social Security numbers, financial account details, and other sensitive records, and that Gas Express should have stopped it.
Gas Express denies wrongdoing and settled to close the case. Anyone who received a breach notification letter from Circle K or Gas Express about the May 2024 incident is in the class.
Claims are due September 3, 2026. You file free with the settlement administrator, and the basic cash option requires no documents.
What the complaint said
Data breach class actions turn on whether a company kept reasonable safeguards and told affected people in time. The plaintiffs argued Gas Express failed on both counts. The settlement resolves those claims without any finding of fault.
Two claim tiers and a monitoring benefit
- A flat $50 cash payment, self-certified, no documentation.
- Up to $2,000 for documented out-of-pocket losses tied to the breach between May 20, 2024 and September 3, 2026, such as identity theft costs, credit monitoring you paid for, or bank charges.
- Two years of CyEx Financial Shield Complete credit monitoring with up to $1 million in identity theft insurance, available to every claimant.
Where it stands and what filing involves
The claims window is open now and closes September 3, 2026. Start the form at gasexpressdatasettlement.com, confirm you received the breach notice, choose the $50 tier or the documented-loss tier, and upload records only if you are claiming losses. Save the confirmation number.
The administrator reviews submissions after the deadline and pays approved claims once the court grants final approval. Payout's free app also links to this form, though going straight to the administrator works the same way.
Questions about the Circle K Data Breach case
Who qualifies for the Circle K data breach settlement?
U.S. residents who received a data breach notification from Gas Express LLC, the Circle K operator, about the May 2024 cyberattack.
Do I need to prove losses for the $50 Circle K payment?
No. The $50 tier is self-certified. Documentation is required only for the up-to-$2,000 loss reimbursement.
Is the credit monitoring separate from the cash?
No. Every claimant can enroll in two years of CyEx monitoring in addition to whichever cash tier they choose.
There are more like this open right now
Payout tracks the whole docket and files the settled ones you qualify for. Free.