never heard about this... is this legit? I'm a customer and never got a letter about it
You know it’s legit by the incredibly legitimate domain name.
CA settlements almost always have standalone domain names and minimal branding like this precisely because the company at fault doesn't want to be associated with the settlement.
It is legit, but you need to prove your losses due to the breach.