You know it’s legit by the incredibly legitimate domain name.
CA settlements almost always have standalone domain names and minimal branding like this precisely because the company at fault doesn't want to be associated with the settlement.
It is legit, but you need to prove your losses due to the breach.