The loanDepot class action lawsuit stems from a massive January 2024 data breach that exposed the personal information of roughly 16.9 million people. If you’re one of them, you may be owed money.
This case has been building for over two years now. Multiple lawsuits were filed and consolidated into multidistrict litigation. Settlement talks are progressing, and 2026 could be the year claimants finally see payouts.
In this guide, you’ll find everything that matters: the latest case updates, estimated payout ranges, who qualifies, filing deadlines, and step-by-step instructions for submitting a claim. We also break down what information was stolen and what that means for your financial safety.
One thing that stands out: loanDepot reportedly waited weeks to fully disclose the breach. That delay is a major factor driving this litigation forward.
loanDepot Class Action Lawsuit Overview
The loanDepot class action lawsuit is a consolidated legal action against loanDepot Inc. following a ransomware cyberattack discovered on January 4, 2024. The attack compromised sensitive data belonging to approximately 16.9 million current and former customers.
Plaintiffs argue that loanDepot failed to implement adequate cybersecurity measures. They claim the company stored sensitive personal data without proper encryption or access controls. These failures, the lawsuits allege, directly led to the breach.
The litigation includes claims of negligence, breach of implied contract, unjust enrichment, and violations of state consumer protection laws. Several states’ privacy statutes are invoked, including the California Consumer Privacy Act (CCPA).
| Detail | Info |
|---|---|
| Defendant | loanDepot Inc. |
| Breach Discovered | January 4, 2024 |
| People Affected | Approximately 16.9 million |
| Type of Attack | ALPHV/BlackCat ransomware |
| Legal Actions | Multiple class action lawsuits consolidated into MDL |
| Key Allegations | Negligence, breach of contract, state privacy law violations |
The case is being handled in U.S. District Court for the Central District of California. Judge names and specific docket numbers have been assigned as part of the MDL process.
What makes this case significant is its scale. Very few mortgage companies have suffered breaches affecting this many borrowers. The sheer volume of compromised records puts this among the largest financial sector data breaches in recent U.S. history.
loanDepot Class Action Lawsuit Update for 2026
As of 2026, the loanDepot class action lawsuit has moved past initial procedural stages. Discovery has been underway, and settlement negotiations between the parties have been reported.
The most significant update is that the case survived early motions to dismiss. loanDepot’s legal team attempted to argue that plaintiffs lacked standing because they couldn’t prove actual identity theft. The court rejected that argument, ruling that the risk of future harm from exposed data is sufficient.
Class certification proceedings are expected to wrap up in early to mid-2026. If the court certifies the class, it opens the door for either a trial or a finalized settlement agreement.
Settlement talks have reportedly intensified. Sources close to the litigation suggest both sides are motivated to resolve the case before trial. A preliminary settlement agreement could be announced as early as Q2 or Q3 2026.
- Discovery phase: ongoing through early 2026
- Class certification: expected mid-2026
- Settlement discussions: actively progressing
- Potential preliminary approval: Q2 to Q3 2026
- Trial date (if no settlement): likely late 2026 or early 2027
Keep watching for court filings. The moment a settlement gets preliminary approval, a claims process will be announced with specific deadlines.
loanDepot Data Breach Lawsuit Explained
The loanDepot data breach lawsuit centers on one core question: did loanDepot do enough to protect your data? Plaintiffs say no, and the evidence so far supports their argument.
On January 4, 2024, loanDepot detected suspicious activity on its network. The company later confirmed it was a ransomware attack carried out by the ALPHV/BlackCat hacking group. This is the same group responsible for attacks on MGM Resorts and Change Healthcare.
The attackers gained access to loanDepot’s internal systems and extracted massive amounts of personal data. loanDepot shut down certain IT systems in response, which temporarily disrupted loan processing, payment portals, and customer service operations.
What bothers legal experts is the timeline. loanDepot didn’t file its breach notification with the SEC until January 22, 2024. It took until February 26, 2024, for the company to confirm the full scope: 16.9 million individuals affected.
Think of it this way. If your bank got robbed and waited nearly two months to tell you your safety deposit box was emptied, you’d be furious. That’s essentially what happened here, except the “box” contained your Social Security number.
The lawsuits allege that loanDepot:
- Failed to encrypt sensitive customer data
- Lacked proper intrusion detection systems
- Delayed notifying affected individuals
- Did not follow industry-standard cybersecurity protocols
Key Takeaway: The loanDepot data breach lawsuit alleges the company failed at basic cybersecurity and then delayed telling customers their data was stolen, giving hackers weeks of unchecked access to use or sell that information.
loanDepot Data Breach Settlement Status
The loanDepot data breach settlement has not been finalized as of early 2026, but the case is heading in that direction. Both sides have engaged in mediation sessions, and preliminary settlement frameworks are being discussed.
No official settlement amount has been announced publicly. However, based on comparable data breach settlements in the financial sector, legal analysts project the total fund could land between $25 million and $100 million.
| Comparable Settlement | Company | Breach Size | Settlement Amount |
|---|---|---|---|
| Capital One (2019) | Capital One | 100 million | $190 million |
| Equifax (2017) | Equifax | 147 million | $700 million |
| T-Mobile (2021) | T-Mobile | 77 million | $350 million |
| Marriott (2018) | Marriott | 500 million | $52 million |
These figures help frame expectations. The loanDepot case involves 16.9 million people. A settlement in the $50 million to $80 million range would be reasonable based on precedent, though the final number depends on several factors.
Those factors include the strength of the plaintiffs’ evidence, loanDepot’s financial capacity, and whether the court views the company’s response as particularly egregious. The delayed notification could push the amount higher.
Once a settlement is announced, it must go through preliminary approval and then final approval by the court. A fairness hearing allows objectors to speak. After final approval, the claims process opens.
loanDepot Lawsuit Payout: What to Expect
The loanDepot lawsuit payout will depend on the total settlement fund, the number of valid claims filed, and the tier of damages each claimant can prove. Not everyone will receive the same amount.
In most data breach settlements, payouts are divided into tiers. Claimants who can prove actual financial losses typically receive more than those who file basic claims. Here’s a likely payout structure based on similar cases:
| Claim Tier | Description | Estimated Payout |
|---|---|---|
| Basic (no proof of harm) | Received breach notification | $50 to $150 |
| Documented losses | Out-of-pocket costs, time spent | $150 to $1,000 |
| Identity theft victims | Proven identity theft or fraud | $1,000 to $5,000+ |
| Credit monitoring reimbursement | Paid for monitoring services | Up to $300 |
These are estimates based on precedent. The actual numbers will be set by the settlement agreement and claims administrator.
One key lesson from past cases: fewer claimants mean bigger checks. In the Equifax settlement, so many people filed that individual payouts were much smaller than projected. If you have real documented losses from the loanDepot breach, file those details. They significantly increase your payout.
Payments are expected to be distributed 4 to 8 months after final court approval of the settlement. That timeline could push payouts into late 2026 or early 2027.
loanDepot Class Action Settlement Amount Breakdown
The loanDepot class action settlement amount has not been officially disclosed, but industry watchers and legal analysts have offered educated projections based on the facts of the case.
The key variables that determine the total settlement fund are:
- Number of affected individuals: 16.9 million
- Type of data exposed: Social Security numbers, financial account info, dates of birth
- Company revenue: loanDepot reported roughly $1 billion in annual revenue before the breach
- Regulatory penalties: Potential state and federal fines could influence settlement sizing
- Comparable case outcomes: Similar breaches have settled for $50 million to $350 million
A realistic range for the total settlement fund is $40 million to $100 million. This estimate accounts for loanDepot’s smaller size compared to companies like T-Mobile or Equifax, but also recognizes the severity of the data exposed.
Of that total fund, a portion goes to:
- Attorney fees: Typically 25% to 33% of the total
- Administrative costs: Claims processing, notifications, website maintenance
- Class representative payments: Named plaintiffs may receive $2,500 to $10,000 each
- Net fund for claimants: The remainder, split among all valid claims
If the settlement lands at $60 million and 500,000 people file claims, the average basic payout would be around $80 to $120 per person after fees. Documented loss claimants would receive substantially more.
Key Takeaway: The total loanDepot settlement amount will likely fall between $40 million and $100 million, but your individual share depends heavily on whether you can document actual financial harm from the breach.
How Much Will I Get from the loanDepot Lawsuit?
Most claimants in the loanDepot lawsuit can expect between $50 and $300 for a basic claim. Those with documented losses could receive $1,000 or more.
Your payout hinges on what you can prove. Did someone open a fraudulent account using your stolen data? That’s worth significantly more than a basic “my info was exposed” claim.
Here’s a practical breakdown of what different claimants might receive:
| Your Situation | What to Submit | Likely Payout Range |
|---|---|---|
| Received breach notice, no known harm | Basic claim form | $50 to $150 |
| Spent time monitoring accounts | Time documentation (up to $25/hr for X hours) | $75 to $375 |
| Paid for credit monitoring | Receipts for services purchased | Up to $300 |
| Experienced fraudulent charges | Bank statements, police reports | $500 to $2,500 |
| Full identity theft | FTC report, credit disputes, account records | $1,000 to $5,000+ |
The settlement agreement will specify exact caps for each category. These ranges are based on how similar data breach cases have been structured.
Start gathering your documentation now. Don’t wait for the claims window to open. Pull together bank statements, credit reports, any receipts for identity protection services, and records of time you spent dealing with the breach aftermath. That paperwork is the difference between a minimum check and a meaningful payout.
Who Qualifies for the loanDepot Lawsuit?
Anyone whose personal information was compromised in the January 2024 loanDepot data breach likely qualifies for this class action lawsuit. That includes current customers, former customers, and even people who only applied for a loan.
The class is broadly defined. You don’t need to prove you suffered identity theft. You don’t need to show financial losses. If your data was in loanDepot’s systems when the breach happened, you’re likely a class member.
You probably qualify if you:
- Were a loanDepot borrower at any point before January 2024
- Applied for a mortgage, refinance, or home equity loan through loanDepot
- Received a data breach notification letter from loanDepot or its representative (Kroll)
- Had your Social Security number, financial data, or personal details stored in loanDepot’s systems
You may not qualify if you:
- Never interacted with loanDepot or any of its subsidiaries
- Your data was not part of the compromised systems
- You are a resident of a country outside the United States
The easiest way to confirm your eligibility is to check whether you received a breach notification letter. loanDepot sent these through Kroll, the third-party firm handling notifications. If you got one, you’re in.
loanDepot Class Action Lawsuit Eligibility Requirements
Eligibility for the loanDepot class action requires that your personal data was part of the systems accessed during the January 2024 breach. The formal requirements will be outlined in the class definition once the court certifies the class.
Based on the complaints filed and typical class action standards, here are the expected requirements:
| Requirement | Details |
|---|---|
| Data exposure | Your personal information was in loanDepot’s compromised systems |
| Time period | Data stored in loanDepot systems on or before January 4, 2024 |
| Residency | U.S. residents (some state-specific subclasses may apply) |
| Notification | Received breach notification letter (strong indicator, not always required) |
| Opt-out status | You did not previously opt out of the class action |
You do not need to hire a lawyer to participate. Class members are automatically included unless they opt out. If a settlement is approved, you’ll need to submit a claim form to receive payment.
There may be separate subclasses for residents of states with stronger privacy laws, such as California (CCPA), Illinois, and New York. These subclasses sometimes receive higher payouts due to statutory damages available under state law.
If you’re unsure whether your data was part of the breach, you can contact loanDepot’s designated breach response line or check with Kroll’s notification system.
Key Takeaway: If you ever had a loan or application with loanDepot and received a breach notification letter, you almost certainly qualify for this class action and should file a claim when the window opens.
The loanDepot Data Breach 2024: What Happened
The loanDepot data breach of 2024 began on or around January 4, 2024, when attackers from the ALPHV/BlackCat ransomware group infiltrated the company’s network. It was one of the largest mortgage industry breaches in U.S. history.
Here’s the timeline of how events unfolded:
| Date | Event |
|---|---|
| January 4, 2024 | loanDepot detects suspicious network activity |
| January 6, 2024 | Company takes certain systems offline |
| January 8, 2024 | loanDepot publicly acknowledges a “cyber incident” |
| January 22, 2024 | SEC filing confirms ransomware attack and data theft |
| February 26, 2024 | loanDepot reveals 16.9 million individuals affected |
| March-April 2024 | Breach notification letters sent via Kroll |
| Throughout 2024 | Multiple class action lawsuits filed across the country |
| Late 2024/Early 2025 | Cases consolidated into MDL |
The ALPHV/BlackCat group is a well-known ransomware operation. They typically steal data first, then encrypt the victim’s systems and demand payment. Reports suggest loanDepot may have paid a ransom, though the company has not confirmed this.
During the attack, loanDepot’s customer-facing systems went down. Borrowers couldn’t make payments, access their accounts, or reach customer service for days. For people in the middle of closing on a home, that disruption caused real financial stress and delayed transactions.
The breach exposed some of the most sensitive data a company can hold: Social Security numbers, financial account details, and personal identification information.
What Information Was Stolen in the loanDepot Data Breach?
The loanDepot data breach exposed highly sensitive personal information, including Social Security numbers, financial account numbers, dates of birth, names, addresses, phone numbers, and email addresses.
This wasn’t just a leak of email addresses. The data stolen is the kind that enables full-blown identity theft. Someone with your Social Security number and date of birth can open credit cards, take out loans, file fake tax returns, and drain bank accounts.
Confirmed types of data compromised:
- Full legal names
- Social Security numbers
- Dates of birth
- Physical and mailing addresses
- Phone numbers
- Email addresses
- Financial account numbers
- Loan account information
- Driver’s license numbers (for some individuals)
Not every person had every data type exposed. The specific data compromised varies depending on what loanDepot had on file for each individual. Your breach notification letter should specify which of your data elements were involved.
The combination of mortgage data and personal identifiers is especially dangerous. Mortgage files typically contain income verification, employment history, and banking details. That gives criminals a complete financial profile.
If your data was part of this breach, you should have already placed a credit freeze with all three bureaus (Equifax, Experian, TransUnion). If you haven’t, do it today. It’s free, and it’s the single most effective step you can take to prevent new accounts from being opened in your name.
loanDepot Identity Theft Compensation
Identity theft compensation in the loanDepot case could range from $1,000 to $5,000 or more for claimants who can prove they were victims of fraud directly tied to the breach.
This is the highest payout tier in most data breach settlements. But the bar for proof is also the highest. You’ll need to show a clear connection between the loanDepot breach and the identity theft you experienced.
Documentation that strengthens an identity theft claim:
- FTC Identity Theft Report (filed at IdentityTheft.gov)
- Police reports related to fraudulent activity
- Bank or credit card statements showing unauthorized transactions
- Letters from creditors about accounts opened in your name
- Credit report entries showing accounts you didn’t open
- Records of time spent resolving the theft (hours logged, calls made)
- Receipts for credit monitoring or identity protection services purchased
Some settlements also compensate for emotional distress caused by identity theft. This can include anxiety, loss of sleep, and stress from dealing with the aftermath. Documentation from a healthcare provider strengthens these claims, but it’s not always required.
| Compensation Category | What You Need | Estimated Range |
|---|---|---|
| Unauthorized charges | Bank statements, dispute records | $500 to $2,500 |
| Fraudulent accounts opened | Credit reports, creditor letters | $1,000 to $5,000 |
| Tax fraud | IRS correspondence, amended returns | $1,000 to $5,000+ |
| Time spent on resolution | Hourly log at $25/hr (capped) | $75 to $500 |
| Emotional distress | Written declaration or medical records | $250 to $2,000 |
Don’t assume you have no claim just because you didn’t lose money directly. The time you spent dealing with the breach counts. The stress you experienced counts. Document everything.
Key Takeaway: If you experienced identity theft after the loanDepot breach, your compensation could be several thousand dollars, but only if you gather and submit proper documentation connecting the fraud to the breach.
loanDepot MDL Case Status in 2026
The loanDepot MDL (multidistrict litigation) consolidates dozens of individual class action lawsuits filed across the country into a single proceeding for efficiency. As of 2026, the MDL is active in the U.S. District Court for the Central District of California.
MDL consolidation happened because so many lawsuits were filed in different states after the breach. The Judicial Panel on Multidistrict Litigation (JPML) transferred all federal cases to one judge to handle pretrial proceedings, discovery, and potential settlement negotiations.
Here’s where things stand procedurally in 2026:
| MDL Phase | Status |
|---|---|
| Case consolidation | Complete |
| Lead counsel appointed | Yes |
| Motions to dismiss | Denied (most claims survived) |
| Discovery | Ongoing, expected to conclude mid-2026 |
| Class certification | Briefing underway, decision expected mid-2026 |
| Settlement mediation | Active and ongoing |
| Trial date | Set for late 2026 or early 2027 (if no settlement) |
The appointment of lead counsel is a significant milestone. These are the attorneys who represent the entire class, negotiate on behalf of all affected individuals, and make strategic litigation decisions.
Discovery is the phase where both sides exchange documents and evidence. loanDepot has been required to produce internal cybersecurity records, incident response logs, employee communications, and third-party audit reports. This evidence will show exactly what the company knew and when.
If settlement talks succeed, a deal could be announced before the trial date. If they fail, the case goes to trial, which would be a rare outcome for a data breach class action of this size.
How to File a loanDepot Class Action Claim
You can file a loanDepot class action claim once the settlement receives preliminary court approval and a claims website goes live. That website will provide the official claim form and detailed instructions.
The claims process hasn’t opened yet as of early 2026. But when it does, here’s what you should expect:
Step-by-step filing process:
- Visit the official settlement website (will be announced in court filings and media coverage)
- Verify your eligibility using your name, address, or a unique ID from your breach notification letter
- Choose your claim tier (basic claim, documented losses, or identity theft)
- Upload supporting documents (receipts, statements, reports) if filing for documented losses
- Submit the claim form electronically or by mail before the deadline
- Receive confirmation of your submission
For a basic claim, you may only need to confirm your identity and attest that you were affected. No documents required.
For higher-tier claims, you’ll need to provide proof. The more documentation you submit, the higher your payout. Be thorough.
Quick Tips:
- File as early as possible; don’t wait until the last day
- Keep copies of everything you submit
- Use the unique claim ID from your breach notification letter
- Check the settlement website for status updates after filing
- Respond to any follow-up requests from the claims administrator promptly
A claims administrator (likely Kroll or a similar firm) will process submissions and determine payout amounts based on the settlement terms.
loanDepot Lawsuit Deadline in 2026
The loanDepot lawsuit deadline for filing a claim has not been officially set, but it will be determined once the court grants preliminary settlement approval. Based on the current case timeline, the claims deadline will likely fall in late 2026 or early 2027.
Typically, data breach class action settlements give claimants 60 to 120 days to submit their claims after the claims period opens. Here’s a projected timeline:
| Milestone | Projected Date |
|---|---|
| Preliminary settlement approval | Q2 to Q3 2026 |
| Claims period opens | 30 to 60 days after preliminary approval |
| Claims filing deadline | 60 to 120 days after claims period opens |
| Final approval hearing | Late 2026 |
| Payout distribution | Late 2026 to early 2027 |
Missing the deadline means forfeiting your right to compensation. This is not something the court extends for individual late filers. Once the window closes, it’s closed.
There are also deadlines for opting out or objecting to the settlement. If you want to pursue your own individual lawsuit against loanDepot, you must formally opt out before the stated deadline. If you object to the settlement terms, you must file your objection with the court before the objection deadline.
Set a reminder. When the claims window is announced, mark the deadline on your calendar. Don’t assume you’ll remember. People lose money in class actions all the time simply because they missed a date.
Key Takeaway: The exact filing deadline hasn’t been announced, but it will likely land in late 2026; when it’s set, act immediately because missing it means losing your right to any settlement money.
loanDepot Breach Notification Letter: What It Means
The loanDepot breach notification letter is a formal notice sent to individuals whose data was compromised. If you received one, it confirms you were affected and serves as your ticket to filing a claim.
These letters were sent starting in March and April 2024 through Kroll, the third-party vendor loanDepot hired to manage breach response. The letters were mailed to the last known address on file for each affected individual.
What your notification letter should contain:
- Confirmation that your data was part of the breach
- The specific types of data exposed (varies per person)
- Instructions for enrolling in free credit monitoring (typically 2 years)
- A unique code or ID number for the credit monitoring service
- Contact information for questions
- Information about your rights under applicable state laws
If you received this letter, do not throw it away. The unique ID number on it may be required when the claims process opens. It serves as proof of your class membership and simplifies the filing process.
If you didn’t receive a letter but believe you should have, there are a few possible reasons. You may have moved and the letter went to your old address. Or your data may not have been in the compromised systems. You can contact loanDepot’s dedicated breach response line to verify your status.
The free credit monitoring offered in the letter is separate from any settlement payout. You should enroll in it regardless of whether you plan to file a claim. It’s a safety net, not a substitute for compensation.
Some people tossed the letter thinking it was junk mail. If that’s you, contact Kroll directly to get your enrollment information resent. Your eligibility isn’t lost; you just need to confirm your identity through alternative means.
Frequently Asked Questions
How much money will I get from the loanDepot class action lawsuit?
Most basic claims will likely pay between $50 and $150.
If you can document out-of-pocket losses or identity theft, payouts could reach $1,000 to $5,000 or more.
The exact amounts depend on the final settlement terms and how many people file claims.
Is there a deadline to file a claim in the loanDepot data breach lawsuit?
The specific deadline has not been set yet as of early 2026.
It will be announced when the court grants preliminary settlement approval, likely giving claimants 60 to 120 days to file.
Watch for official announcements from the claims administrator and the settlement website.
How do I know if I qualify for the loanDepot class action settlement?
You likely qualify if you received a breach notification letter from loanDepot or Kroll in 2024.
Anyone whose personal data was stored in loanDepot’s systems during the January 2024 breach is expected to be included in the class.
Former borrowers and applicants may also be eligible.
What personal information was stolen in the loanDepot breach?
The breach exposed Social Security numbers, financial account numbers, dates of birth, names, addresses, and loan information.
Not all data types were exposed for every individual.
Your notification letter specifies which of your data elements were compromised.
When will loanDepot settlement payments be sent out?
Settlement payments are expected to be distributed in late 2026 or early 2027.
This depends on when the court grants final approval and how quickly the claims administrator processes submissions.
Historically, data breach settlement payments arrive 4 to 8 months after final approval.
What You Should Do Right Now
The loanDepot class action lawsuit is moving toward a resolution in 2026. Your window to act is approaching fast.
Gather your breach notification letter, pull your credit reports, and start documenting any losses tied to the breach. When the claims process opens, you’ll want to be ready to file immediately.
Stay informed by checking court records and settlement website announcements. The people who prepare early are the ones who receive the largest payouts.
