Flagstar Bank has agreed to a $31.5 million settlement to resolve a class-action lawsuit stemming from two cyberattacks in 2021 that compromised the personal information of over 2.9 million customers. Eligible claimants could receive payments ranging from $100 up to $25,000.
The settlement addresses claims that Flagstar Bank did not adequately protect sensitive customer data and delayed notification following the breaches. The first incident occurred in January 2021, affecting just over 1.4 million users, followed by a second attack in December 2021 that impacted over 1.5 million users.
While Flagstar Bank has denied any wrongdoing, the bank agreed to the settlement after a mediation process overseen by a retired federal judge, seeking to avoid the costs and uncertainties of a prolonged legal battle.
To qualify for a payout, individuals must have received a notification indicating their personal information was impacted in the 2021 data breaches. Payments will vary based on the nature of the claim and the number of valid claims submitted. Those seeking the maximum $25,000 payment must provide documentation of losses directly related to the breaches, such as expenses for fraud, identity theft, or credit monitoring.
Other claimants may receive residual payments estimated between $60 and $599, depending on the remaining funds in the settlement pool after other claims and costs are disbursed.
Customers in California who can prove they were affected are eligible for up to $100. All eligible claimants can also opt for a free credit monitoring package, which includes three-bureau credit monitoring, $1 million in identity theft insurance, dark web monitoring, and identity restoration services.
Claim forms must be submitted by August 11, 2026. Further details, including frequently asked questions and claim forms, are available on the settlement website. Flagstar Bank, headquartered in Hicksville, New York, operates approximately 340 branch locations across the United States.