Cyber Incident Victim: Flagstar Bank FSB

In January 2021, hackers allegedly accessed the personal information of more than 1.4 million Flagstar Bank customers. A second breach occurred in December 2021, affecting additional customers. Plaintiffs in a subsequent complaint alleged that the Hicksville, New York‑based financial institution failed to adequately protect customer data and delayed notifying affected individuals about both incidents. The bank’s headquarters are located in Hicksville, New York.

The proposed class action settlement was announced on August 4, 2026, and provides for a total fund of $31.5 million. Approximately 2.19 million individuals are included in the settlement class. Flagstar Bank denied any wrongdoing but agreed to the settlement to avoid prolonged litigation. Under the settlement, eligible claimants may receive reimbursement for documented out‑of‑pocket losses up to $25,000, including costs related to fraud, identity theft, credit monitoring, and attorneys’ or accountants’ fees. Class members who were California residents at the time of the breaches may be eligible for an additional $100 payment under the California Consumer Privacy Act. A pro rata cash payment of about $60 is available to class members without requiring proof of loss, with the exact amount dependent on the number of valid claims and associated legal costs.

The settlement also provides three years of three‑bureau credit monitoring services from IDX, accompanied by $1 million in identity theft insurance, dark web monitoring, and identity restoration services. Claimants must submit a valid claim by August 11, 2026, either online or by mailing a completed PDF claim form to the settlement administrator. The deadline to object to or be excluded from the settlement was June 29, 2026. Payments will be distributed after the claims administration process concludes, subject to court approval.