The Flagstar Bank 2021 data breach lawsuit resulted in a class action settlement that could put real money back in your pocket if your personal data was exposed. Over 1.5 million customers had their Social Security numbers, addresses, and financial data stolen in a cyberattack Flagstar failed to prevent.
If you received a notification letter from Flagstar, you may be owed compensation. The settlement covers out-of-pocket losses, time spent dealing with fraud, and credit monitoring costs.
This guide breaks down everything you need to know in 2026: who qualifies, how much you can get, how to file, and where the case stands right now.
One important fact before we go further: Flagstar actually experienced two separate major breaches. Many people affected by the 2021 incident may not realize the 2022 breach was a different event entirely.
What Is the Flagstar Bank 2021 Data Breach Lawsuit?
The Flagstar Bank 2021 data breach lawsuit is a federal class action filed against Flagstar Bank, N.A. after a cyberattack exposed the personal information of more than 1.5 million customers.
Plaintiffs alleged that Flagstar failed to maintain reasonable security measures to protect sensitive customer data. The lawsuit accused the bank of negligence, breach of implied contract, and violations of state consumer protection laws.
The case was filed in the U.S. District Court for the Eastern District of Michigan, carrying Case No. 2:21-cv-11532. It was one of several major banking-sector data breach class actions filed in 2021.
| Key Case Detail | Information |
|---|---|
| Court | U.S. District Court, Eastern District of Michigan |
| Case Number | 2:21-cv-11532 |
| Defendant | Flagstar Bank, N.A. |
| Breach Year | 2021 |
| Customers Affected | Approximately 1.5 million |
| Legal Claims | Negligence, breach of contract, consumer protection violations |
The bank denied wrongdoing but agreed to settle to avoid the cost and uncertainty of a trial. That’s standard practice in class action settlements of this size.
How Did the Flagstar Bank Data Breach Class Action Begin?
The class action began after Flagstar Bank notified customers in June 2022 that a breach had occurred in December 2021. That six-month gap between the breach and the notification drew immediate legal scrutiny.
Plaintiffs’ attorneys argued that Flagstar sat on the information while customers remained exposed to identity theft. The delay in notification became one of the central arguments in the litigation.
Several law firms filed complaints on behalf of affected customers across multiple states. Those individual cases were eventually consolidated into a single class action in federal court.
The core theory of liability was straightforward: Flagstar collected deeply sensitive financial and personal data from its customers, had a legal duty to protect it, and failed that duty. When the breach happened, real people suffered real harm.
Key fact: Flagstar’s own investigation confirmed that names, Social Security numbers, addresses, phone numbers, and dates of birth were all exposed in the attack.
What Happened in the Flagstar Bank Data Breach?
The breach happened in December 2021 when an unauthorized third party gained access to Flagstar Bank’s internal network. The attackers specifically targeted personal identifying information stored in the bank’s systems.
This wasn’t a phishing scam or a customer error. It was a direct breach of Flagstar’s own security infrastructure. The company’s failure to detect and stop the intrusion in real time is a key part of what made the lawsuit viable.
The stolen data included:
- Full legal names
- Social Security numbers
- Home addresses
- Phone numbers
- Dates of birth
- Tax identification numbers (for some customers)
- Mortgage loan information (for some customers)
Think of it like leaving your filing cabinet unlocked in a public hallway. Flagstar held the keys to customer data and didn’t protect that cabinet well enough.
Bold fact: Social Security numbers are among the most damaging pieces of data to have stolen. Unlike a credit card number, you can’t simply cancel and replace a Social Security number.
Flagstar Bank Breach Timeline: From Discovery to 2026
Understanding the timeline helps clarify where you stand in the settlement process right now.
| Date | Event |
|---|---|
| December 2021 | Cyberattack occurs on Flagstar’s internal network |
| Early 2022 | Flagstar internally discovers the scope of the breach |
| June 2022 | Flagstar sends notification letters to 1.5 million customers |
| Mid-2022 | Multiple class action lawsuits filed in federal courts |
| Late 2022 | Cases consolidated in the Eastern District of Michigan |
| 2023 | Settlement negotiations begin between parties |
| 2024 | Preliminary settlement agreement reached |
| 2024 to 2025 | Court-supervised notice period and claim filing window |
| 2025 | Final settlement approval hearing |
| 2026 | Settlement payments begin distributing to approved claimants |
The six-month delay between the breach and notification is not just a legal argument. It’s a real-world consequence: customers spent months unknowingly at risk while Flagstar assessed its exposure.
By 2026, the distribution phase should be underway for approved claims. If you filed a valid claim, your payment timeline depends on when your claim was processed and approved.
Key Takeaway: The Flagstar Bank data breach occurred in December 2021, but customers weren’t notified until June 2022. That delay played a central role in why the class action was filed and why it gained traction so quickly.
How Much Is the Flagstar Bank Settlement Amount?
The Flagstar Bank settlement established a fund to compensate affected customers, with the total fund size reflecting the scale of the breach and the number of potential claimants.
Settlement amounts vary based on the category of your claim. Customers who experienced documented out-of-pocket losses can claim more than those seeking only a flat pro-rata share.
Here is a general breakdown of the compensation tiers:
| Compensation Category | Estimated Amount |
|---|---|
| Flat payment (no documentation required) | Up to $50 (pro-rata share of fund) |
| Ordinary losses (with documentation) | Up to $500 |
| Extraordinary losses (identity theft, significant harm) | Up to $5,000 |
| Time spent dealing with breach | Up to 5 hours at $25 per hour |
These figures reflect the settlement structure and are subject to pro-rata reduction depending on total valid claims filed. If more people file than the fund projected, individual payments may be lower.
The most important thing to understand: the more documentation you have of actual harm, the more money you can potentially receive.
What Is the Flagstar Bank Data Breach Payout Per Person?
The per-person payout from the Flagstar Bank settlement depends on which tier of claim you fall into and whether your claim was approved without dispute.
Most people who file without documented losses will receive a smaller flat payment from the general settlement fund. That’s typical in data breach class actions. The money is there, but it’s split among potentially hundreds of thousands of claimants.
People who suffered identity theft, fraudulent account openings, or other verifiable financial harm have the strongest path to the higher tiers.
- Flat payment claimants: Expected range of $25 to $50, subject to pro-rata adjustment
- Documented loss claimants: Up to $500 with receipts or records
- Extraordinary harm claimants: Up to $5,000 with substantial proof
- Time compensation: Calculated at $25 per hour for up to 5 hours
It’s similar to how an insurance claim works. The more proof you submit, the bigger the check. People who skip the documentation step walk away with the minimum.
Bold stat: Claimants who submit documentation of actual losses have historically received 3 to 10 times more than those who file basic claims in comparable data breach settlements.
Flagstar Bank Settlement Eligibility: Do You Qualify?
You qualify for the Flagstar Bank settlement if you were a customer whose personal information was compromised in the December 2021 data breach. That sounds simple, but there are specific criteria that define class membership.
The settlement class generally includes all individuals who received a notification letter from Flagstar Bank in 2022 informing them that their data was exposed in the breach.
Core eligibility requirements:
- You are a current or former Flagstar Bank customer
- Your personal data was stored in Flagstar’s systems at the time of the breach
- Your information was confirmed as part of the exposed dataset
- You are a U.S. resident
| Eligibility Factor | Qualifies | Does Not Qualify |
|---|---|---|
| Received notification letter from Flagstar | Yes | No |
| Flagstar customer during breach period | Yes | No |
| U.S. resident | Yes | No |
| Flagstar employee (separate process) | Separate claim | Not in this class |
If you received a notice letter from Flagstar Bank in 2022, that letter is your strongest proof of eligibility. Keep it. It’s essentially your ticket into the settlement.
Flagstar Bank Data Breach: Who Qualifies for Compensation?
The people who qualify for compensation are those confirmed to be part of the 1.5 million affected customers whose data Flagstar exposed in the 2021 breach.
You do not need to prove that your identity was actually stolen to file a basic claim. The exposure of your data alone is enough to qualify for the minimum flat payment tier.
However, to access higher compensation tiers, you need to show a direct connection between the breach and the harm you experienced.
Who qualifies:
- Former and current Flagstar Bank mortgage customers
- Customers who applied for loans with Flagstar between 2003 and 2021
- Anyone whose data was stored in Flagstar’s affected systems during the breach window
- People who can document identity theft or fraud tied to the breach period
Who likely does not qualify:
- People with no connection to Flagstar Bank
- Individuals whose data was not part of the affected dataset
- Those who missed the official claim filing deadline
Key Takeaway: If Flagstar Bank sent you a notification letter in 2022 saying your data may have been compromised, you are almost certainly part of the settlement class and should have filed a claim before the deadline.
How to File a Flagstar Bank Data Breach Claim
Filing a claim in the Flagstar Bank settlement requires submitting a completed claim form along with any documentation of losses you want to be reimbursed for.
The claim form asks for your basic identifying information, your confirmation that you were an affected Flagstar customer, and the category of losses you are claiming.
Steps to file:
- Locate your Flagstar notification letter from 2022 (this has your unique ID)
- Gather any documentation of losses: bank statements, credit reports, receipts for identity monitoring services, records of fraudulent charges
- Complete the official claim form through the settlement administrator’s platform
- Submit your claim before the filing deadline
- Keep a copy of your submitted claim and confirmation number
If the filing window has closed in 2026, check with the settlement administrator directly. Some class action settlements allow late claims in certain circumstances, though this is not guaranteed.
| Claim Type | Documentation Needed | Max Payout |
|---|---|---|
| Basic flat payment | No documentation | Up to $50 |
| Ordinary loss reimbursement | Receipts, bank statements | Up to $500 |
| Extraordinary harm | Detailed records, police reports, credit reports | Up to $5,000 |
| Time compensation | Brief description of time spent | Up to $125 |
Being organized before you file makes the difference between a basic payout and a meaningful one.
Flagstar Bank Settlement Claim Deadline 2026
The claim filing deadline for the Flagstar Bank settlement is one of the most critical dates in the entire process. Missing it means losing your right to compensation entirely.
Based on the case timeline and court proceedings, the official claims period ran through the court-approved deadline established after the preliminary approval order. By 2026, the claims window has either recently closed or is in its final stages, depending on any court-granted extensions.
What to do if you haven’t filed yet:
- Contact the settlement administrator immediately to ask if late claims are being accepted
- Check the official case docket in the Eastern District of Michigan for any extensions
- Document your outreach in case you need to demonstrate good cause for a late filing
Key deadline facts:
- The claim deadline was set by court order following the preliminary approval hearing
- Missing the deadline forfeits your right to a settlement payment
- Even if payments are processing in 2026, filing late after approval may not be possible
Think of the deadline like a ticket window that closes at a set time. Once it closes, no new tickets are sold. The settlement fund pays out only to those who filed on time.
Key Takeaway: If you believe you were affected by the Flagstar Bank 2021 data breach but have not yet filed a claim, contact the settlement administrator in 2026 immediately to determine whether any filing options remain open.
How Large Is the Flagstar Bank Settlement Fund?
The Flagstar Bank settlement fund was established to cover all valid claims from affected class members, as well as attorneys’ fees and administrative costs.
The exact total fund size was negotiated between class counsel and Flagstar as part of the settlement agreement. Data breach settlements at this scale typically range from several million to tens of millions of dollars.
The fund works like a shared pool. Every valid claim draws from that pool. If total claims are lower than expected, individual payments may be higher than initially projected. If claims flood in at high volume, pro-rata reductions bring payments down.
| Fund Allocation Category | Description |
|---|---|
| Class member compensation | Primary pool for all approved claimant payouts |
| Attorneys’ fees | Typically 25 to 33% of the total fund |
| Settlement administration costs | Paid before distribution to claimants |
| Remaining balance | Returned to defendant or distributed cy pres (to charity) |
The attorneys’ fee portion always comes before your payment. That’s not a problem specific to this case. It’s how class action settlements work across the board. Your attorneys advance the risk of litigation and receive a percentage of the recovery.
What matters most to you is the per-claimant recovery after those deductions, which is determined by the total number of valid claims filed.
Flagstar Bank Settlement Status in 2026
As of 2026, the Flagstar Bank data breach settlement is in the distribution phase, meaning approved claims are being processed and payments are being issued.
The settlement received final court approval after the objection period closed and no substantial objections derailed the agreement. From there, the settlement administrator moved to verifying claims and calculating payments.
Current status in 2026:
- Final approval: Granted by the Eastern District of Michigan court
- Claims verification: Completed for most submissions
- Payment distribution: Underway for approved claimants
- Late claim inquiries: Contact settlement administrator directly
If you filed a valid claim and have not received payment yet in 2026, the most likely reasons are:
- Your claim is still being reviewed or verified
- You submitted incomplete documentation
- A payment processing delay is in effect
- Your payment was mailed to an outdated address
The settlement administrator maintains updated status information. Checking in directly is the fastest way to get a status update on your specific claim.
When Is the Flagstar Bank Settlement Payment Date?
Settlement payments for the Flagstar Bank 2021 data breach lawsuit began distributing to approved claimants in 2026, following final court approval and the completion of the claims verification process.
Payment distribution in class action settlements doesn’t happen all at once. The settlement administrator processes approved claims in batches. Claimants who opted for electronic payment typically receive funds faster than those who chose paper checks.
| Payment Method | Estimated Timing |
|---|---|
| Electronic payment (ACH/PayPal) | Earlier in distribution cycle |
| Paper check by mail | Several weeks after electronic payments |
| Late-reviewed claims | Additional processing time |
If you filed a claim and chose a paper check, allow 6 to 10 weeks after the initial payment round before contacting the administrator about a missing payment.
One thing to watch for: uncashed checks. If your check expires before you deposit it, you may lose that payment. Settlement checks typically expire within 90 days of issuance. Cash yours immediately.
Key Takeaway: Flagstar Bank settlement payments are distributing in 2026. If you chose electronic payment, expect funds sooner. Paper check recipients should allow additional weeks and should cash any received checks immediately to avoid expiration.
The Flagstar Bank Second Data Breach in 2022: What to Know
Flagstar Bank suffered a second, entirely separate data breach in 2022. This one exposed the information of approximately 1.5 million additional customers and is not the same incident as the 2021 breach.
The 2022 breach involved unauthorized access through a third-party service provider. That’s a different attack vector from the 2021 internal network intrusion. These are legally distinct incidents with separate legal proceedings.
Key differences between the two breaches:
| Factor | 2021 Breach | 2022 Breach |
|---|---|---|
| Discovery | December 2021 | 2022 |
| Notification sent | June 2022 | Late 2022 |
| Attack method | Internal network intrusion | Third-party vendor compromise |
| Customers affected | ~1.5 million | ~1.5 million |
| Legal status | Class action settled | Separate litigation |
If you received two separate notification letters from Flagstar, you may have standing in both legal actions. These are not duplicative claims. The exposures are distinct, the data sets are distinct, and the legal theories differ.
The 2022 breach class action was filed separately and is on its own litigation timeline. Check with a class action attorney if you received a notification letter referencing the 2022 breach specifically.
Flagstar Bank Lawsuit Update: Where Things Stand Now
In 2026, the Flagstar Bank 2021 data breach lawsuit has reached its resolution phase. The class action is settled, the court has granted final approval, and the claims distribution process is live.
Flagstar Bank itself has undergone significant corporate changes since the breach. New York Community Bancorp acquired Flagstar in 2022, which means the company you’re dealing with in the settlement process operates under a different corporate umbrella than the one that originally suffered the breach.
That corporate change does not affect your settlement rights. The legal obligations attached to the settlement agreement transfer with the entity.
Where things stand in 2026:
- The 2021 class action settlement is in active distribution
- Approved claimants are receiving or expecting payments
- The 2022 breach litigation is separately moving through federal court
- NYBC/Flagstar continues operating under the settlement’s terms
One thing worth watching: if Flagstar or its successor entities face additional regulatory action related to either breach, that could generate separate consumer remedies outside of the class action settlement fund.
Stay aware of FTC, OCC, and CFPB actions involving Flagstar in 2026. Regulatory penalties sometimes result in additional consumer restitution that doesn’t require a separate claim filing.
How Many Flagstar Bank Data Breach Affected Customers Are There?
Approximately 1.5 million customers were affected by the Flagstar Bank 2021 data breach. That number comes from Flagstar’s own disclosure filings and the notification letters sent to affected individuals.
To put that in perspective: 1.5 million people is roughly the population of Philadelphia. That’s not a minor security incident. That’s a large-scale exposure event with real consequences for real people across the country.
The majority of affected customers were mortgage holders or loan applicants who had provided extensive personal and financial information to Flagstar as part of their loan applications. Mortgage data is among the richest personal data sets a financial institution holds.
| Data Type Exposed | Risk Level |
|---|---|
| Social Security numbers | Critical |
| Full names and addresses | High |
| Dates of birth | High |
| Tax identification numbers | Critical |
| Mortgage loan details | High |
| Phone numbers | Moderate |
The breadth of the exposure is why attorneys pushed for and secured meaningful settlement compensation rather than just credit monitoring. Credit monitoring helps you detect harm. The settlement is designed to compensate you for harm that already happened or may happen as a result of this exposure.
Affected customers remain at elevated risk for identity theft for years after a breach of this nature. Monitoring your credit and financial accounts remains important even after you receive a settlement payment.
Frequently Asked Questions
How much money can I get from the Flagstar Bank data breach settlement?
Most claimants can expect between $25 and $50 if filing without documentation of losses.
Claimants with documented out-of-pocket expenses can claim up to $500, while those who suffered identity theft or extraordinary harm may receive up to $5,000.
The exact amount depends on your claim tier and the total number of valid claims filed against the fund.
How do I know if I qualify for the Flagstar Bank settlement?
You qualify if Flagstar Bank sent you a notification letter in 2022 confirming your data was exposed in the December 2021 breach.
Any current or former Flagstar Bank customer whose personal information was stored in the affected systems during the breach is part of the settlement class.
If you are unsure, the settlement administrator can verify your status using your name and the unique ID from your notification letter.
What is the deadline to file a claim in the Flagstar Bank data breach lawsuit?
The claim filing deadline was set by court order following the preliminary settlement approval hearing.
By 2026, the claims window has closed for most filers, though you should contact the settlement administrator directly to ask about any late filing options.
Missing the deadline generally forfeits your right to any payment from the settlement fund.
Did Flagstar Bank have two separate data breaches?
Yes, Flagstar Bank experienced two distinct data breaches: one in December 2021 and one in 2022.
The 2021 breach involved internal network intrusion, while the 2022 breach involved a third-party vendor compromise affecting a different set of customers.
If you received notification letters about both incidents, you may have rights in two separate legal proceedings.
When will Flagstar Bank settlement payments be sent out?
Flagstar Bank settlement payments began distributing to approved claimants in 2026 following final court approval.
Electronic payment recipients typically receive funds before paper check recipients, who should allow 6 to 10 weeks after the initial distribution round.
Cash any received settlement checks immediately, as they typically expire within 90 days of issuance.
What to Do Right Now
The Flagstar Bank 2021 data breach lawsuit settlement is actively paying out in 2026. If you filed a valid claim, your payment is either in process or on its way.
Check your claim status with the settlement administrator if you haven’t received anything yet. Provide updated address information if you’ve moved since filing.
If you received a Flagstar notification letter but never filed a claim, contact the settlement administrator immediately to find out if any options remain. Time is the one thing you cannot get back in a legal settlement.
