The loan depot data breach lawsuit is one of the largest financial data breach class actions currently active in the United States, and if you were a LoanDepot customer in or before January 2024, you may be entitled to real money. Nearly 16.9 million people had their most sensitive financial data stolen in a cyberattack that crippled LoanDepot’s systems for weeks.
This guide covers everything: what was stolen, who qualifies, what compensation looks like, and what you need to do in 2026 to protect your right to a payout.
The case is moving. Courts are active. Deadlines matter.
What Is the Loan Depot Data Breach Lawsuit?
The loan depot data breach lawsuit is a consolidated class action filed in federal court on behalf of millions of customers whose personal and financial data was stolen during a January 2024 ransomware attack on LoanDepot Inc.
Multiple individual lawsuits were filed almost immediately after the breach became public. Federal courts consolidated many of them into a single action in the U.S. District Court for the Central District of California, which is one of the busiest federal venues for consumer data breach litigation in the country.
Plaintiffs allege that LoanDepot failed to implement reasonable cybersecurity protections and failed to act quickly enough when the breach occurred.
The core legal theories include negligence, negligence per se, unjust enrichment, breach of implied contract, and violations of California’s Consumer Privacy Act (CCPA) along with the federal Gramm-Leach-Bliley Act (GLBA).
| Case Detail | Information |
|---|---|
| Defendant | LoanDepot Inc. |
| Court | U.S. District Court, Central District of California |
| Attack Date | January 2024 |
| Estimated Victims | 16.9 million |
| Legal Theories | Negligence, CCPA, GLBA, Breach of Contract |
| Case Type | Consolidated Class Action |
What Happened in the LoanDepot Cyberattack?
In early January 2024, LoanDepot detected unauthorized access to its systems. The company confirmed it was a ransomware attack. Hackers encrypted internal systems and stole a massive volume of consumer data before LoanDepot could contain the damage.
LoanDepot’s online loan payment portal went down. The myloandepot.com customer platform became inaccessible. Borrowers could not make mortgage payments online for days, which caused real financial stress for millions of people.
The company sent breach notification letters beginning in late January and into February 2024 as it confirmed the scope of the attack.
The attack’s timing hit hard. January is a month when many homeowners are catching up after the holidays. Losing access to your mortgage payment portal is not just inconvenient. It can cause cascading issues with escrow, credit reporting, and lender communication.
| Timeline Event | Date |
|---|---|
| Cyberattack detected | January 4, 2024 |
| Systems taken offline | January 6 to 8, 2024 |
| Public disclosure | January 8, 2024 |
| Breach notifications begin | Late January 2024 |
| First lawsuits filed | January and February 2024 |
What Data Was Stolen in the LoanDepot Breach?
The LoanDepot breach exposed some of the most sensitive personal and financial data a person can have. This was not just a name-and-email situation.
According to breach notifications sent to affected individuals, the stolen data included Social Security numbers, financial account numbers, dates of birth, full names, physical addresses, phone numbers, and email addresses.
For mortgage customers, this also meant loan origination data, application details, and credit-related information were potentially in criminal hands.
- Social Security numbers
- Financial account numbers
- Dates of birth
- Full legal names
- Home addresses
- Phone numbers
- Email addresses
- Loan and mortgage account details
- Credit inquiry data
This combination of data creates an identity theft risk that can follow victims for years. A stolen SSN combined with mortgage account details is everything a fraudster needs to open credit lines, file false tax returns, or take out loans in someone else’s name.
Key fact: The combination of SSNs plus mortgage data is considered among the highest-risk data breach categories by cybersecurity experts.
Key Takeaway: The LoanDepot cyberattack in January 2024 exposed the full financial profiles of nearly 17 million people, including Social Security numbers and mortgage account data, making this one of the most serious breaches in the mortgage lending industry.
LoanDepot Ransomware Attack Explained
The LoanDepot attack was a ransomware event, which means hackers did not just steal data. They also encrypted LoanDepot’s internal systems and demanded payment to restore access.
Ransomware attacks follow a pattern. A criminal group infiltrates a network, quietly moves through internal systems collecting data, then deploys encryption software that locks the target out of their own files. The attackers demand a ransom. Whether or not the ransom is paid, the stolen data is often kept or sold.
Cybersecurity researchers linked the intrusion to tactics used by known ransomware operations, though LoanDepot did not publicly confirm which group was responsible at the time of filing.
What made this attack particularly damaging was LoanDepot’s size. As one of the largest nonbank mortgage lenders in the United States, its systems contained financial profiles for millions of borrowers across the country.
| Ransomware Attack Phase | What Happened |
|---|---|
| Initial Access | Hackers entered LoanDepot’s network (exact method undisclosed) |
| Data Exfiltration | Customer records copied before encryption deployed |
| Encryption | Internal systems locked, operations disrupted |
| Disclosure | LoanDepot publicly confirmed attack January 8, 2024 |
| Notification | Breach letters sent to 16.9 million affected customers |
Who Qualifies for the LoanDepot Data Breach Lawsuit?
You likely qualify for the LoanDepot data breach lawsuit if you received a breach notification letter from LoanDepot or if you were a LoanDepot customer whose personal information was stored in the company’s systems before the January 2024 attack.
Eligibility is broader than many people assume. You do not need to have experienced confirmed identity theft or fraud to participate. The lawsuit includes people who faced the risk of harm, the time and expense of monitoring their credit, and the anxiety of knowing their sensitive data is in criminal hands.
You may qualify if:
- You received a data breach notification letter from LoanDepot
- You had an active mortgage, home equity product, or loan application with LoanDepot before January 2024
- Your Social Security number or financial account data was confirmed as part of the exposed data set
- You spent time and money protecting yourself after learning of the breach (credit freezes, monitoring services, etc.)
- You experienced any fraudulent activity or identity theft linked to the breach
| Eligibility Factor | Qualifies? |
|---|---|
| Received breach notification letter | Yes |
| Had loan or mortgage with LoanDepot | Yes |
| Applied for LoanDepot loan (application data stored) | Likely Yes |
| Experienced fraud or identity theft after breach | Yes (stronger claim) |
| No letter received but was a customer | Check with claims administrator |
How Many LoanDepot Data Breach Affected Customers Are There?
Approximately 16.9 million people were affected by the LoanDepot data breach, making it one of the largest mortgage industry data breaches in U.S. history.
LoanDepot confirmed this figure in its SEC filing and in subsequent breach notification communications. That number represents a significant portion of LoanDepot’s customer base across decades of mortgage originations and servicing.
To put that in perspective, that is roughly 5% of the entire United States population receiving a letter saying their most sensitive financial data was stolen. This is not a small incident tucked into a footnote.
The sheer scale of the affected population is one reason federal courts moved quickly to consolidate multiple individual lawsuits. Managing 16.9 million potential claimants requires centralized coordination.
16.9 million people: That is larger than the entire population of the state of Illinois.
Was Your LoanDepot Mortgage Customer Data Exposed?
Your LoanDepot mortgage customer data was exposed if you had any financial relationship with LoanDepot and your personal records were stored in the compromised systems at the time of the attack.
This includes people who:
- Finalized a home purchase loan through LoanDepot
- Refinanced their mortgage with LoanDepot
- Applied for but did not complete a loan (application data still stored)
- Held a home equity line of credit or home equity loan through LoanDepot
- Had their loan transferred or serviced by LoanDepot at any point
Even if you paid off your LoanDepot loan years ago, your records may have remained in their system. Data retention practices in the mortgage industry often mean old records sit in databases long after accounts are closed.
The safest assumption: if you ever did business with LoanDepot, check whether you received a notification letter and verify with the claims process.
Key Takeaway: Qualification for the LoanDepot lawsuit extends beyond current customers. Former borrowers and people who only submitted applications may also have claims worth pursuing.
What Is the LoanDepot Data Breach Settlement Amount?
As of 2026, no final settlement amount has been publicly confirmed in the LoanDepot data breach class action, but the case is in active stages of litigation and negotiation.
Settlement discussions in large data breach class actions typically begin after courts rule on motions to dismiss and class certification. Given the timeline of filings starting in early 2024, the case is likely approaching a stage where settlement talks are serious.
Comparable mortgage and financial data breach settlements offer useful reference points:
| Comparable Data Breach Settlement | Settlement Amount | Per-Person Payout |
|---|---|---|
| Capital One Data Breach (2021) | $190 million | Up to $25,000 (documented losses) |
| T-Mobile Data Breach (2022) | $350 million | Up to $25,000 |
| Equifax Data Breach (2019) | $425 million | $125 base; more with proof of harm |
| Marriott Data Breach (2024) | $52 million | Varied by harm level |
LoanDepot’s exposure, given the 16.9 million victims and the nature of the stolen data, suggests a settlement fund in the tens of millions to hundreds of millions is possible.
LoanDepot Data Breach Compensation and Damages: What You Can Recover
LoanDepot data breach compensation falls into several damage categories depending on the harm you experienced and the evidence you can provide.
Courts in data breach cases recognize both out-of-pocket losses and non-economic harms. Plaintiffs’ attorneys in this case are pursuing several damage types on behalf of the class.
Compensable damage categories:
- Out-of-pocket losses: Costs you paid for credit monitoring, identity theft protection services, credit freezes, and fraud remediation
- Lost time: Hours spent dealing with fraud, replacing documents, or monitoring accounts
- Fraudulent charges: Any financial losses directly traceable to the breach
- Future risk costs: Ongoing exposure costs for the remaining lifetime risk of identity theft
- Statutory damages: CCPA violations carry statutory damages of $100 to $750 per consumer per incident
The CCPA angle is significant. California’s Consumer Privacy Act allows statutory damages even without proof of actual harm. For 16.9 million claimants, the math at the low end of $100 each produces a theoretical exposure of $1.69 billion. That creates real settlement leverage.
LoanDepot Breach Settlement Payout Tiers Broken Down
Data breach settlements typically pay out in tiers based on the level of harm documented by each claimant. The LoanDepot settlement, when reached, is expected to follow this standard model.
Think of it like an insurance claim. The more documentation you provide, the higher the tier you can qualify for.
| Payout Tier | Who Qualifies | Estimated Range |
|---|---|---|
| Tier 1: Base claim | All verified class members with no specific documented harm | $50 to $150 |
| Tier 2: Time and inconvenience | Claimants who document time spent on breach response | $100 to $300 |
| Tier 3: Out-of-pocket losses | Claimants with receipts for monitoring services, etc. | $300 to $1,000+ |
| Tier 4: Documented fraud or identity theft | Victims with direct financial losses tied to breach | Up to $5,000+ |
Note: These are estimated ranges based on comparable settlements. Final tiers and amounts depend on court approval and total number of valid claims filed.
Key Takeaway: The more documentation you have of time spent, money paid, and harm suffered from the LoanDepot breach, the higher your potential payout tier in the settlement.
How to File a LoanDepot Data Breach Claim
Filing a LoanDepot data breach claim requires waiting for the formal claims process to open, which happens after a settlement receives preliminary court approval and a claims administrator is appointed.
Here is what the process typically looks like and what you should be doing right now to prepare:
Step 1: Confirm you are in the class
Check whether you received a breach notification letter. If you are unsure, gather your LoanDepot account information. Former borrowers can also qualify.
Step 2: Gather documentation
Collect any evidence of harm or protective action:
- Receipts for credit monitoring services you purchased
- Records of time spent on fraud resolution
- Any fraudulent account activity notices
- Correspondence from LoanDepot about the breach
Step 3: Watch for official settlement notice
Once a settlement is approved, the claims administrator sends notice via email or mail. This notice will include your unique claim ID and instructions.
Step 4: Submit your claim form
Claim forms are typically available online through the official settlement website. Answer all questions accurately. Attach documentation for higher-tier claims.
Step 5: Wait for payment
After the claims period closes and the court grants final approval, payments are distributed. This typically takes several months after the deadline.
LoanDepot Data Breach Claim Filing Deadline: Don’t Miss It
The specific filing deadline for the LoanDepot data breach claim has not been set as of early 2026 because no formal settlement has received preliminary court approval yet.
However, deadlines in data breach class actions are firm and non-negotiable once set. Missing a claims deadline means you forfeit your right to compensation from the settlement fund, even if you were clearly harmed.
In similar cases, claims deadlines typically run 60 to 120 days after the official notice is sent to class members.
What you should do right now:
- Keep your contact information updated with any attorneys involved in the case
- Save any LoanDepot correspondence, including your breach notification letter
- Document all expenses and time related to protecting yourself from the breach
- Watch your email for notice from a claims administrator
Do not wait for a second notice. The first official claim form notice is often the only one you will receive before the deadline.
| Deadline Type | When It Occurs | What Happens If Missed |
|---|---|---|
| Opt-out deadline | After preliminary approval | You cannot sue LoanDepot separately |
| Objection deadline | After preliminary approval | You cannot object to settlement terms |
| Claim filing deadline | After settlement notice sent | You lose all right to payment |
LoanDepot Data Breach Notification: Did You Get a Letter?
LoanDepot sent official data breach notification letters beginning in late January 2024 and continuing into February 2024 as the company confirmed which records were affected.
The notifications were sent by first-class mail to last-known addresses on file and in some cases by email. They identified the type of information exposed and offered affected customers credit monitoring and identity protection services for a period of time.
If you did not receive a letter but believe you were a LoanDepot customer, there are a few possibilities. Your address may have changed. The letter may have been discarded as junk mail. Or your records may be in a portion of the database that was initially unconfirmed.
What to do if you did not get a letter but think you qualify:
- Gather old LoanDepot account statements or correspondence
- Contact plaintiff law firms handling the case
- Watch for the official settlement website, which will have a lookup tool for class members
The absence of a notification letter does not automatically disqualify you from the class. Courts and claims administrators have lookup mechanisms to verify class membership.
Key Takeaway: Missing a LoanDepot breach notification letter does not mean you are out of the lawsuit. Keep your old account records and contact plaintiff attorneys to verify your status.
LoanDepot Class Action Lawsuit Status in 2026
As of 2026, the LoanDepot data breach class action is in active federal court proceedings. The case has moved past the initial complaint filing stage and is working through motions, discovery, and class certification.
Judges overseeing consolidated cases in the Central District of California have been managing the litigation calendar to keep things moving. Defense motions to dismiss were filed in 2024 and courts have largely allowed the core claims to proceed.
The class certification motion, which asks the court to formally recognize the millions of affected customers as a legal class, is among the most important near-term milestones. A favorable ruling on certification dramatically increases settlement pressure on LoanDepot.
Key milestones in the timeline:
| Milestone | Approximate Date |
|---|---|
| Breach occurs | January 2024 |
| First lawsuits filed | January to February 2024 |
| Consolidation into single case | Mid-2024 |
| Motions to dismiss ruled on | Late 2024 to early 2025 |
| Discovery phase | 2025 |
| Class certification motion | 2025 to 2026 |
| Settlement negotiations | Ongoing into 2026 |
| Potential preliminary settlement approval | Late 2026 (estimated) |
LoanDepot Identity Theft Lawsuit: Separate Claims You May Have
Some LoanDepot breach victims may have claims that go beyond the class action. If you experienced actual identity theft, fraudulent account openings, or direct financial losses traceable to the LoanDepot breach, individual claims may be worth pursuing in addition to or separately from the class action.
Individual identity theft claims can be filed in state court under state consumer protection laws. California’s Identity Theft Act, for example, provides for actual damages plus attorney fees. Other states have similar statutes.
The practical difference between a class claim and an individual identity theft claim comes down to dollar amounts. Class action settlements spread money across millions of people. Individual claims, when properly documented, can recover the full extent of personal financial harm.
If you have experienced any of the following, speak with an attorney about individual claim options:
- New credit accounts opened in your name without authorization
- Tax returns filed fraudulently using your SSN
- Medical identity theft
- Loan applications submitted in your name
- Direct financial losses exceeding $5,000
Opting out of the class action before the opt-out deadline preserves your right to pursue individual claims. But opting out means you cannot collect from the class settlement fund. This is a real decision requiring careful thought.
LoanDepot Lawsuit Settlement Update 2026
The most current LoanDepot lawsuit settlement update heading into 2026 shows the case is progressing toward resolution, though no formal settlement has been announced as of this writing.
Litigation of this scale rarely moves fast. The Equifax breach settlement, for comparison, took roughly three years from the breach to final settlement approval. The Capital One settlement took about two years. LoanDepot’s timeline puts it potentially on track for a settlement announcement in late 2026 or early 2027.
That said, large defendants under financial pressure sometimes settle faster to avoid the continuing cost of litigation and the reputational damage of prolonged proceedings. LoanDepot, which went through financial difficulties in 2023 and 2024, has additional motivation to resolve major legal exposure.
What to watch for in 2026:
- Class certification ruling
- Settlement agreement announcement
- Preliminary court approval hearing
- Official claims notice issued to 16.9 million class members
- Claims period opening date
Staying informed means watching for the official settlement website, monitoring your email and physical mail for notice, and keeping records of any ongoing harm.
16.9 million class members. One settlement fund. Early filers with documentation get more.
Frequently Asked Questions
How much money can I get from the LoanDepot data breach settlement?
No final settlement amount has been confirmed yet, but comparable cases suggest base payouts of $50 to $150 for standard claims.
Claimants with documented fraud, out-of-pocket losses, or identity theft could recover $500 to $5,000 or more.
The final amount depends on total claims filed, court approval, and your documentation level.
How do I know if I was affected by the LoanDepot data breach?
LoanDepot sent breach notification letters to approximately 16.9 million affected customers starting in late January 2024.
If you received a letter, you are confirmed as an affected individual.
If you were a LoanDepot customer but did not receive a letter, you should gather your old account records and contact the claims administrator once the settlement site goes live.
What is the deadline to file a LoanDepot data breach claim?
No official claims deadline has been set as of early 2026 because the settlement has not yet received preliminary court approval.
Once a settlement is approved and notice goes out, the claims period is typically 60 to 120 days.
Watch your mail and email closely and act immediately when you receive official notice.
Can I still join the LoanDepot class action lawsuit in 2026?
Yes, class members do not need to take any action to be included in the class action before a settlement is announced.
If you are a qualifying class member, you are automatically included unless you actively opt out.
You will receive an official notice explaining your rights to participate, opt out, or object.
What information was stolen in the LoanDepot cyberattack?
LoanDepot confirmed that Social Security numbers, financial account numbers, dates of birth, names, addresses, phone numbers, and email addresses were among the stolen data.
Mortgage-related data including loan details and application information was also part of the exposed records.
This combination is among the highest-risk categories of stolen data because it enables full identity theft for years after the breach.
The LoanDepot data breach lawsuit is real, it’s serious, and it’s moving toward resolution in 2026. Nearly 17 million people had their financial lives exposed, and the courts are working toward accountability.
Your job right now is simple. Find your old breach notification letter. Document every dollar you spent and every hour you lost dealing with the fallout. Watch for official settlement notice to arrive in your inbox or mailbox.
When that claim form arrives, fill it out completely and submit it before the deadline. That is how you get your piece of this settlement.
