SAG-AFTRA members have settled a lawsuit against the union health plan over a data breach that exposed their personal information.

Lawyers for the actors on Tuesday told the court that theyve reached a settlement of this dispute, in principle. The terms werent disclosed.

The proposed class action accused the SAG Health, a trust established to provide health benefits to members, of failing to adequately safeguard member data, employ basic security measures and timely notify members of the breach. It brought claims for negligence, invasion of privacy and unjust enrichment, among others, and sought at least $5 million. The filing of the lawsuit followed a data breach last year in which information including names, social security numbers and health insurance and medical details was obtained through an email phishing attack. Its unknown how many members were affected by the breach.

SAG-AFTRA members alleged that they werent notified of the breach until December, nearly three months after the union learned of it. They argued theyre now at an increased risk of identity theft and fraud.

This exfiltrated personal data, the full extent of which SAG Health has failed to disclose to the public, allows hackers to gain a clear image of each individual and track their whereabouts, leading hackers to each victims behavior and background, wrote Yana Hart, a lawyer for the members, in the complaint. This effectively provides criminals with a key to their personal lives, making it easy to match additional data, gaining access to their personal accounts and insight on their preferences.

The lawsuit also claimed that members overpaid for their health plans in light of the data breach.

SAG-AFTRA initiation fees are $3,000, with annual dues of $236 plus roughly 1.5 percent of covered earnings. Members must pay $375 per quarter for health coverage.