Settlement preliminarily approved July 1, 2026; claims deadline was October 21, 2026; final approval hearing November 5, 2026
Dartmouth's 750,000 Dollar Oracle Breach Settlement: Claims Closed October 21, Final Approval Hearing Set for November 5
Dartmouth College agreed to a 750,000 dollar class action settlement over the August 2025 zero-day breach of Oracle's E-Business Suite, an incident attributed to the Cl0p ransomware group that affected more than 100 corporate and institutional organizations. The Dartmouth class covers roughly 96,911 people whose information may have been accessed; court documents list names, dates of birth, Social Security numbers, and financial account details among the compromised data, drawn from the payroll, human resources, and accounting systems the college ran on Oracle EBS. The settlement, which received preliminary approval on July 1, 2026, offers up to 5,000 dollars for documented losses, an estimated 75 dollar pro rata payment without documentation, and two years of credit monitoring. The claims window closed on October 21, 2026, and the court holds its final approval hearing on November 5, 2026; benefits are paid only after final approval and any appeals. Dartmouth denies the allegations and states the settlement is not an admission of fault or liability, and the wider litigation continues against Oracle and other defendants who have not settled.
Executives
The entry point was a zero-day in a vendor's enterprise suite, and the cost still landed on the customer whose data it held: notification, litigation, a settlement fund, and monitoring for nearly 97,000 people. Vendor contracts and vendor patch latency for the systems holding your most sensitive records are executive risk decisions, not procurement details.
CIO / CISO
Map which business systems hold Social Security numbers and financial account data, who patches them, and how fast a critical vendor zero-day would actually be closed in your environment. The Oracle EBS campaign hit more than 100 organizations through one product; concentration in a single enterprise suite is a measurable exposure, and your incident cost model should assume the settlement pattern seen here, not just recovery costs.
Engineers
For internet-facing enterprise suites, treat vendor zero-day announcements as emergency change events: isolate, patch, and hunt for webshells and unexpected exports before returning to normal cadence. Keep the evidence chain, access logs, export records, and patch timestamps, because litigation two years later will ask for exactly those records.
Everyone (non-IT)
If you received a Dartmouth settlement notice, the October 21 claims deadline has passed and the court decides final approval on November 5. More broadly, when a college or employer announces a breach involving a payroll system, take the free credit monitoring and consider a credit freeze; Social Security numbers do not expire.