Frequently Asked Questions

A Court authorized this notice to inform you how you may be affected by this proposed Settlement. This notice describes the lawsuit, the general terms of the proposed Settlement and what it may mean to you. This notice also explains how to participate in, or exclude yourself from, the Settlement if your information was compromised in the Data Breach.

For information on how to determine if you are a Settlement Class Member, and therefore eligible for benefits under this Settlement, see FAQ 5.

On November 27, 2022, Gunster determined that third-party cybercriminals had gained access to Gunster’s systems (the “Data Breach”). The lawsuit claims that Gunster is responsible for the Data Breach. Specifically, Plaintiffs are bringing, on behalf of a putative nationwide class, negligence claims, breach of implied contract claims, unjust enrichment claims, breach of fiduciary duty claims, and claims under the Florida Deceptive and Unfair Trade Practices Act against Gunster. The crux of Plaintiffs’ claims is that Gunster should be liable for allowing the Data Breach to occur because it should have had more stringent cybersecurity. Gunster denies these claims and any wrongdoing. It contends that the Data Breach was carried out by a sophisticated threat actor(s) who was able to overcome Gunster’s cybersecurity defenses. No court or other judicial entity has made any judgment or other determination of any wrongdoing by Gunster. The Settlement was reached before Gunster filed its response to Plaintiffs’ Complaint and before the Parties engaged in formal discovery (including the production of documents and presentation of witnesses for deposition). If litigation had continued, each party would have offered expert witnesses to testify as to whether Gunster’s cybersecurity program was reasonable and whether Plaintiffs could prove damages on a class-wide basis. Gunster would also likely move for summary judgment, arguing that the undisputed evidence proves that Plaintiffs’ claims would fail. Motion practice and discovery would create significant uncertainty as to whether Plaintiffs would be able to continue to assert claims on behalf of a nationwide class and whether Plaintiffs or Gunster would ultimately prevail in the litigation.

In a class action, one or more people called “class representatives” sue on behalf of themselves and other people with similar claims. All of these people together are the “class” or “class members.” Because this is a class action Settlement, even persons who did not file their own lawsuit can obtain benefits provided under the Settlement, except for those individuals who exclude themselves from the Settlement Class by the deadline. 

The Court has not decided in favor of Plaintiffs or Gunster. Instead, both sides agreed to a Settlement after a lengthy mediation process overseen by a neutral mediator. Settlements avoid the costs and uncertainty of a trial and related appeals, while more quickly providing benefits to members of the Settlement Class. The class representatives appointed to represent the class and the attorneys for the Settlement Class (“Class Counsel,” see FAQ 13) believe that the Settlement is in the best interests of the Settlement Class Members.

You are a Settlement Class Member if your personal information was compromised, accessed, exfiltrated, or otherwise impacted by the Data Breach.

If you are not sure whether you are included in the Settlement, you may call 1-866-597-4701 or email [email protected] with questions.

The Settlement provides:

• Compensation for lost time addressing issues related to the Data Breach;

• Compensation for unreimbursed, out-of-pocket expenses;

• Three years of three-bureau credit monitoring (see FAQ 7);

• Payment of costs of notifying Settlement Class Members and administering the Settlement;

• Payment of Attorneys’ Fees, costs, and expenses, as approved by the Court (see FAQ 14); and

• Injunctive relief, including a number of security commitments by Gunster designed to prevent attacks similar to the Data Breach from occurring in the future.

Settlement Benefit: Cash Payment for Ordinary Attested Time: Settlement Class Members who spent time responding to the notice of the Data Breach or in response to the Data Breach can make a claim for reimbursement for up to 7 hours of time at a rate of $30.00/hour.

To claim reimbursement for Ordinary Attested Time, you must provide an attestation and brief description of the actions taken in response to receiving notice of the Data Breach and the time associated with each action.

Settlement Benefit: Payment for Ordinary Out-of-Pocket Losses: Settlement Class Members who have documented out-of-pocket losses as a result of the Data Breach can make a claim for reimbursement up to $2,500.00. Ordinary Out-of-Pocket Losses that are eligible for reimbursement include the following:

• costs associated with accessing or freezing/unfreezing credit reports with any credit reporting agency;

• other miscellaneous expenses incurred related to any Ordinary Out-of-Pocket Loss such as notary, fax, postage, copying, milage, and long-distance telephone charges; and

• credit monitoring or other mitigative costs.

To claim reimbursement for Ordinary Out-of-Pocket Losses, you must submit documentation supporting this claim, including, but not limited to, credit card statements, bank statements, invoices, telephone records, and receipts.

The total amount of compensation you may claim for ordinary out-of-pocket losses and ordinary attested time cannot exceed $2,500.00 in the aggregate.

Settlement Benefit: Cash Payment for Extraordinary Attested Time: Settlement Class Members who spent time remedying identity theft, fraud, or other misuse of personal information related to the Data Breach can make a claim for reimbursement for up to 10 hours of time at a rate of $30.00/hour.

To claim reimbursement for Extraordinary Attested Time, you must provide an attestation and brief description of the actions taken to remedy identity theft, fraud, or other misuse of your information related to the Data Breach and the time associated with each action.

Settlement Benefit: Payment for Extraordinary Losses: Settlement Class Members that have documented identity theft, fraud, or other extraordinary losses that are fairly traceable to the Data Breach can make a claim for reimbursement of up to $35,000.00. Extraordinary Losses that are eligible for reimbursement include unreimbursed costs, losses, or expenditures incurred as a result of identity theft or identity fraud, falsified tax returns, real estate title fraud, banking fraud, or other possible misuse of your personal information.

To claim reimbursement for Extraordinary Losses, you must submit documentation to support that the loss claimed was the result of the Data Breach.

The total amount of compensation that can be claimed for Ordinary Out-of-Pocket Losses, Ordinary Attested Time, Extraordinary Losses, and Extraordinary Attested Time cannot exceed $35,000.00 per individual, and the total amount of Attested Time (Ordinary and Extraordinary) cannot exceed 10 hours per person.

The Settlement Administrator will decide if your claim for Ordinary Attested Time, Ordinary Out-of-Pocket Losses, Extraordinary Attested Time, and/or Extraordinary Losses is valid. Only valid claims will be paid. The deadline to file a claim for Ordinary Attested Time, Ordinary Out-of-Pocket Losses, Extraordinary Attested Time, and/or Extraordinary Losses is August 2, 2025.
The amount of your claim may be reduced or increased depending on the total amount of claims. See FAQ 8.

Settlement Class Members can submit a claim for three years of three-bureau credit monitoring services, including dark web scanning, identity theft insurance, real-time credit monitoring with Equifax, Experian, and TransUnion, and access to fraud resolution agents.

The deadline to file a claim for Credit Monitoring is August 2, 2025. If you submit a valid Claim Form and elect to enroll in Credit Monitoring, you will receive enrollment instructions by email after the Settlement is final. You must provide your email on the Claim Form to receive this benefit.

The aggregate amount Gunster shall be responsible to pay under this Settlement Agreement is capped at $8,500,000.00. If the total amount of Approved Claims made by Settlement Class Members, together with the Administration and Notice Costs and Attorneys’ Fees and Expenses, exceeds the aggregate cap, Approved Claims will be subject to a pro rata reduction such that the total amount of Settlement benefits paid by Gunster does not exceed the amount of the Settlement.

To file a claim for credit monitoring, for reimbursement for Ordinary Attested Time, Ordinary Out-of-Pocket Losses, Extraordinary Attested Time, and/or Extraordinary Losses, you will need to file a Claim Form with your Unique Class Member ID, which can be found on the postcard notice you received or by contacting the Settlement Administrator. If you believe your personal information was compromised, accessed, exfiltrated, or otherwise impacted in the Data Breach but you did not receive written notice from Gunster, you must include documentation demonstrating why you believe your information was compromised, accessed, exfiltrated, or otherwise impacted.

The easiest way to submit a Claim Form is online, by filling out the form at www.gysdatabreachSettlement.com. You can also download a paper Claim Form and return a completed Claim Form by mail addressed to:

Whalen v. Gunster, Yoakley & Stewart, PA

Settlement Administrator

P.O. Box 301132

Los Angeles, CA 90030-1132

[email protected]

The deadline to file a claim is August 2, 2025 (this is the last day to file online and the postmark deadline for mailed claims).

The Settlement Administrator will decide whether the information provided on each Claim Form is complete and valid. The Settlement Administrator may require additional information. If you do not provide the additional information in a timely manner, the claim will be considered invalid and will not be paid.

Approved Claims are those submitted in a timely manner and found to be valid by and in an amount approved by the Settlement Administrator. Gunster’s payments under the Settlement are subject to the aggregate cap discussed in FAQ 8.

The Court will hold a hearing on August 13, 2025 to decide whether to approve the Settlement Agreement. This hearing date and time may be moved without notice to the class. If the Court approves the Settlement Agreement, there may still be appeals. It is always uncertain whether these appeals can be resolved, and resolving them can take time, perhaps more than a year. Please be patient.

If you make a claim under the Settlement, or if you do nothing, you will be releasing all of your claims relating to the Data Breach against Gunster and any Released Parties when the Settlement becomes final. By releasing your legal claims, you are giving up the right to file, or to continue to pursue, separate legal claims against or seek further compensation from Gunster or any Released Parties for any harm related to the Data Breach or the claims alleged in the lawsuits—whether or not you are currently aware of those claims.

Unless you exclude yourself from the Settlement (see FAQ 15), all of the decisions by the Court will bind you. That means you will be bound to the terms of the Settlement and accompanying court orders, and cannot bring a lawsuit or be part of another lawsuit against Gunster or any Released Parties regarding the Data Breach.

Paragraphs 2.31, 2.32, and 2.43 of the Settlement Agreement define the claims and parties that will be released by Settlement Class Members who do not exclude themselves from the Settlement. You can access the Settlement Agreement and read the specific details of the legal claims being released at www.gysdatabreachSettlement.com.

If you have any questions, you can contact the Settlement Administrator (see FAQ 17).

Yes. The Court appointed John A. Yanchunis of Morgan & Morgan and Brian Murray of Glancy Prongay & Murray LLP as Settlement Class Counsel. You will not be charged by these lawyers for their work on this case. If you want to be represented by your own lawyer, you may hire one at your own expense. Settlement Class Counsel can be reached at (813) 223-5505.

Class Counsel has undertaken this case on a contingency-fee basis, meaning they have paid for all of the expenses in the case and have not been paid any money in relation to their work on this case. Accordingly, Class Counsel will ask the Court to award them Attorneys’ Fees and Expenses. The Court will decide the final amount of Attorneys’ Fees and Expenses to be paid. You will not have to separately pay any portion of these fees yourself. Class Counsel’s request for Attorneys’ Fees and Expenses (which must be approved by the Court) will be filed by May 29, 2025 and will be available to view on the Settlement website at www.gysdatabreachSettlement.com. Any amount approved by the Court will be subject to the aggregate cap referenced in FAQ 8.

If you are a member of the Settlement Class, you may exclude yourself from the Settlement (also known as “opting out”). If you exclude yourself, you will lose any right to participate in the Settlement, including any right to receive the benefits outlined in this notice.

If you decide on this option, you may keep any rights you have, if any, against Gunster, and you may file your own lawsuit against Gunster based upon the same legal claims that are asserted in this lawsuit, but you will need to find your own attorney at your own cost to represent you in that lawsuit. If you are considering this option, you may want to consult an attorney to determine your options.

IMPORTANT: You will be bound by the terms of the Settlement Agreement unless you submit a timely and signed written request to be excluded from the Settlement. To exclude yourself from the Settlement, you must submit a “request for exclusion,” postmarked or electronically submitted no later than July 3, 2025, as follows:

To submit the written request for exclusion via U.S. Mail, please send to:

Whalen v. Gunster, Yoakley & Stewart, PA

Settlement Administrator

P.O. Box 301132

Los Angeles, CA 90030-1132

The statement must contain the following information:

(i) Identify the case name of the Action (“Mary Jane Whalen and Christine V. Rona v. Gunster, Yoakley & Stewart, PA, Case No. 25-CA-000550”);

(ii) Identify the name and address of the individual seeking exclusion from the Settlement;

(iii) Be personally signed by the individual seeking exclusion;

(iv) Include a statement clearly indicating the individual’s intent to be excluded from the Settlement; and

(v) Request exclusion only for that one individual whose personal signature appears on the request.

If you do not comply with these procedures and the deadline for exclusions, you will lose any opportunity to exclude yourself from the Settlement, and your rights will be determined in this lawsuit by the Settlement Agreement if it is approved by the Court.

You can ask the Court to deny approval by filing an objection. You can’t ask the Court to order a different Settlement; the Court can only approve or reject the Settlement. If the Court denies approval, no Settlement payments will be sent out, and the lawsuit will continue. If that is what you want to happen, you should object.

Any objection to the proposed Settlement must be in writing. If you file a timely written objection, you may, but are not required to, appear at the Final Approval Hearing, either in person or through your own attorney. If you appear through your own attorney, you are responsible for hiring and paying that attorney. All written objections and supporting papers must include:

(i) The case name and number of the Action (“Mary Jane Whalen and Christine V. Rona v. Gunster, Yoakley & Stewart, PA, Case No. 25-CA-000550”);

(ii) The name, address, and telephone number of the objecting Settlement Class Member and, if represented by counsel,
of his/her counsel;

(iii) A statement of whether the objection applies only to the objector, to a specific subset of the class, or to the entire class;

(iv) A statement of the specific grounds for the objection; and

(v) A statement of whether the objecting Settlement Class Member intends to appear at the Final Approval Hearing, and if so, whether personally or through counsel.

In addition to the foregoing requirements, if an objecting Settlement Class Member intends to speak at the Final Approval Hearing (whether pro se or through an attorney), the written objection must include a detailed description of any evidence the objecting Settlement Class Member may offer at the Final Approval Hearing, as well as copies of any exhibits the objecting Settlement Class Member may introduce at the Final Approval Hearing.

To be considered by the Court, your written objection must be filed electronically with the Court by July 3, 2025 or mailed, postmarked no later than July 3, 2025, to the following addresses:

If you do not comply with these procedures and the deadline for objections, you may lose any opportunity to have your objection considered at the Final Approval Hearing or otherwise to contest the approval of the Settlement or to appeal from any orders or judgments entered by the Court in connection with the proposed Settlement. You will still be eligible to receive Settlement benefits if the Settlement becomes final even if you object to the Settlement.

The Court has scheduled a Final Approval Hearing to listen to and consider any concerns or objections from Settlement Class Members regarding the fairness, adequacy, and reasonableness of the terms of the Settlement Agreement. That hearing is currently scheduled to take place on August 13, 2025 at 1:30 PM before the Honorable Christine Ann Marlewski, at the Circuit Court of the Thirteenth Judicial Circuit in and for Hillsborough County, Florida located in Edgecomb Courthouse, 800 E. Twiggs St., Tampa, Florida 33602. This hearing date and time may be moved without notice to the class. Please refer to the Settlement website www.gysdatabreachSettlement.com for notice of any changes.

If you have questions about this notice or the Settlement, you may go to the Settlement website at www.gysdatabreachSettlement.com or call 866-974-4701. You can also contact the Settlement Administrator at [email protected] or by mailing a letter to Whalen v. Gunster, Yoakley & Stewart, PA, Settlement Administrator, P.O. Box 301132, Los Angeles, CA 90030-1132 [email protected] for more information or to request that a copy of this document be sent to you in the mail. If you wish to communicate directly with Class Counsel, you may contact them at (813) 223-5505. You may also seek advice and guidance from your own private lawyer at your own expense if you wish to do so.

This notice is only a summary of the lawsuit and the Settlement. Other related documents can be accessed through the Settlement website. If you have questions about the proposed Settlement or wish to receive a copy of the Settlement Agreement but do not have access to the Internet to download a copy online, you may contact the Settlement Administrator. The Court cannot respond to any questions regarding this notice, the lawsuit, or the proposed Settlement.

Please do not contact the Court, its Clerks, or Gunster.