$31.5M Flagstar Bank Data Breach Settlement, Did the 2021 Cyberattacks Expose Your Information? August 11 Is last Date to File for Claim

The Flagstar Bank data breach class action settlement is a $31,500,000 consumer protection case where approximately 2,187,170 U.S. individuals whose personal information was exposed in Flagstar’s two 2021 cyberattacks can claim up to $25,000 in documented losses, a residual cash payment estimated at $60, and three years of free credit monitoring — by filing a claim before August 11, 2026. Flagstar Bank agreed to the settlement after plaintiffs alleged it failed to protect customer and employee data in back-to-back cyberattacks. A federal judge granted preliminary approval on February 20, 2026.

Flagstar Bank Settlement: Quick Facts

Field	Detail
Settlement Amount	$31,500,000
Claim Deadline	August 11, 2026
Who Qualifies	U.S. individuals identified by Flagstar whose personal information was impacted by the January 2021 or December 2021 data breaches
Documented Loss Payout	Up to $25,000 with third-party documentation
Residual Cash Payment	Estimated ~$60; maximum $599 — no proof required
California Statutory Payment	Up to $100 for California residents at time of breach
Credit Monitoring	3 years, three-bureau — free to all class members who file
Proof Required	Only for documented loss claims — residual cash requires no proof
Settlement Status	Preliminarily approved — open for claims
Opt-Out Deadline	June 29, 2026
Objection Deadline	June 29, 2026
Final Approval Hearing	October 1, 2026 at 9:30 a.m. ET (via Zoom)
Administrator	Flagstar Settlement Administrator, P.O. Box 4427, Baton Rouge, LA 70821
Official Website	flagstarsettlement.com
Last Updated	May 16, 2026

Current Status of the Flagstar Settlement

• The U.S. District Court for the Eastern District of Michigan granted preliminary approval on February 20, 2026. The claims portal is now live at flagstarsettlement.com.
• Claims are open now. The deadline to file online or postmark a mail-in form is August 11, 2026.
• The opt-out and objection deadline is June 29, 2026 — act before this date if you want to preserve the right to sue separately.
• The court holds its final approval hearing on October 1, 2026 at 9:30 a.m. ET via Zoom.
• Payments go out after the court grants final approval and any appeals resolve. The court cautions that appeals can take more than a year.

What Is the Flagstar Bank Lawsuit About? Angus, et al. v. Flagstar Bank, N.A., Case No. 2:21-cv-10657-MFL-DRG

Flagstar Bank suffered two separate cyberattacks in 2021, both of which exposed the personally identifiable information (PII) of customers and employees. The consolidated lawsuit before Judge Matthew F. Leitman of the U.S. District Court for the Eastern District of Michigan accuses Flagstar of failing to adequately protect that data and of delaying notification to affected individuals after both breaches.

The first attack struck in January 2021, when cybercriminals infiltrated a file-sharing platform — Accellion’s File Transfer Appliance (FTA) — that Flagstar continued using despite warnings that the vendor had stopped issuing security updates. Flagstar was one of roughly 300 companies that did not switch to a newer, more secure system. Once the platform stopped receiving security patches, hackers exploited the vulnerability and stole data on approximately 1.47 million people. By March 2021, cybercriminals had posted 80 gigabytes of stolen Flagstar data on the dark web.

The second attack hit in December 2021, when hackers infiltrated Flagstar’s internal network and encrypted approximately 30% of the bank’s workstations and servers. Court filings indicate Flagstar paid a $1 million bitcoin ransom to the attackers. This second breach affected approximately 1.58 million individuals, with some overlap between the two groups. Together, both breaches impacted approximately 2,187,170 people. The SEC separately fined Flagstar $3.55 million in December 2024 for making materially misleading statements about the second cyberattack.

Related article: $200,000 Sarasota Memorial Health Care System Settlement For Florida Residents, Did They Overbill You After a Car Accident? July 10 Is Last Date to File a Claim 

The personal information exposed across both breaches included names, Social Security numbers, addresses, phone numbers, dates of birth, and financial account information. This is exactly the type of sensitive data that enables identity theft and long-term financial fraud — which is why the settlement includes three full years of credit monitoring for everyone who files.

For context on how courts handle similar data breach compensation cases involving financial institutions, the Cadence Bank $5.25M MOVEit Data Breach Settlement and the Fidelity Investments $2.5M Data Breach Settlement both involve comparable allegations of inadequate data security at financial firms.

Who Qualifies for the Flagstar Bank Data Breach Settlement?

You may qualify if:

• You are a U.S. resident identified by Flagstar as having your personal information impacted by either or both of the January 2021 or December 2021 data breaches
• You received a settlement notice by email or direct mail from the settlement administrator
• You are a current or former Flagstar Bank customer or employee whose data was stored on affected systems during the breach period
• You reside in California and were a California resident at the time of the breaches — you qualify for the additional California Statutory Payment

California subclass: Approximately 364,000 California residents qualify for the standard benefits plus a California Statutory Payment of up to $100 under California privacy law.

You are NOT included if:

• Flagstar did not identify your information as impacted by either breach
• You are a Flagstar officer, director, or entity with a controlling interest in Flagstar
• You are a judge, judicial officer, or immediate family member of the presiding judge
• You validly opt out of the settlement by June 29, 2026

If you are unsure whether you are a class member, call the administrator at 1-855-542-0397 or email [email protected].

How Much Can You Get from the Flagstar Settlement?

You can claim one, two, three, or all four benefits — they are stackable. Here is what each benefit provides:

1. Documented Monetary Losses — up to $25,000 If you suffered actual out-of-pocket losses traceable to the breaches, you can claim reimbursement up to $25,000. Eligible losses include unreimbursed fraud or identity theft losses, attorneys’ or accountants’ fees, credit repair costs, fees for placing or removing a credit freeze, credit monitoring costs paid since the breach, and miscellaneous expenses like postage, notary, or mileage. You must submit third-party documentation — bank statements, receipts, invoices — prepared by someone other than yourself.

2. Residual Cash Payment — estimated ~$60, maximum $599 All class members can claim a residual cash payment without providing any documentation. Class counsel estimates this at approximately $60 based on expected claim rates, but the exact amount is calculated pro rata after all other settlement costs and claims are paid. It cannot exceed $599 per person. You must file a claim form to receive it — doing nothing means getting nothing.

3. California Statutory Payment — up to $100 (California residents only) California class members can claim an additional statutory payment of up to $100 by attesting under penalty of perjury that they resided in California at the time of the 2021 breaches. No proof of residency documentation is required unless specifically requested.

4. Three Years of Free Credit Monitoring (all class members) All class members who file can enroll in three years of three-bureau credit monitoring provided by IDX, the country’s largest incident response services provider. Coverage includes three-bureau credit monitoring with alerts, $1 million in identity theft insurance, CyberScan dark web monitoring, fully managed identity restoration services, member advisory services, and lost wallet assistance. Enrollment instructions come by email after settlement approval.

How to File Your Flagstar Bank Settlement Claim

Step 1 — Visit flagstarsettlement.com and locate your Settlement Claim ID Number from your postcard or email notice. You need this to file online.

Step 2 — Select which benefits you want to claim: documented losses, residual cash payment, California statutory payment (if applicable), and/or credit monitoring. You can claim all four simultaneously.

Step 3 — For documented monetary losses, describe each cost, provide the approximate date, and upload third-party supporting documentation — bank statements, invoices, receipts — showing the loss was traceable to the breach.

Step 4 — Select your preferred payment method: Venmo, Zelle, PayPal, or paper check. Enter the account details for your chosen electronic payment method, or confirm your mailing address for a check.

Step 5 — Sign the attestation certifying your information is accurate under penalty of perjury and submit your claim.

Step 6 — Save your confirmation. If mailing your claim, postmark the completed form to Flagstar Settlement Administrator, P.O. Box 4427, Baton Rouge, LA 70821 by August 11, 2026. Note: a tear-off claim form mailed with your notice is only sufficient for residual cash, credit monitoring, and California statutory payment — not for documented loss claims, which require the full online or printed form with documentation.

Estimated time to complete (residual cash + credit monitoring): 5–10 minutes. Documented loss claims: 15–20 minutes depending on documentation.

Flagstar Data Breach Settlement Key Dates

Milestone	Date
First Data Breach (Accellion FTA)	January 2021
Second Data Breach (Flagstar Network)	December 2021
Flagstar Announced First Breach	March 5, 2021
Flagstar Announced Second Breach	June 17, 2022
Preliminary Approval Granted	February 20, 2026
Claims Portal Opens	Open now — flagstarsettlement.com
Opt-Out / Objection Deadline	June 29, 2026
Claim Filing Deadline	August 11, 2026
Final Approval Hearing	October 1, 2026 at 9:30 a.m. ET (Zoom)
Expected Payment Date	TBD — after final approval and resolution of any appeals; potentially late 2026 or later if appealed

Frequently Asked Questions About the Flagstar Bank Settlement

Is there a class action settlement against Flagstar Bank? 

Yes. Angus, et al. v. Flagstar Bank, N.A., Case No. 2:21-cv-10657-MFL-DRG, is a consolidated class action in the U.S. District Court for the Eastern District of Michigan before Judge Matthew F. Leitman. It resolves claims from two 2021 cyberattacks affecting approximately 2.187 million people. The court granted preliminary approval on February 20, 2026, and the claims portal at flagstarsettlement.com is now open.

Do I qualify for the Flagstar settlement if I received a breach notice?

 Yes — receiving an official settlement notice is the clearest indicator that Flagstar identified your information as impacted by one or both breaches. If you received a postcard or email from the settlement administrator, you are almost certainly a class member. If you lost your notice, call 1-855-542-0397 to retrieve your Claim ID.

How much will I actually receive from the Flagstar settlement? 

It depends on what you claim. Class members who file only for the residual cash payment with no proof can expect approximately $60, though the exact amount varies by total valid claims. Those with documented out-of-pocket losses traceable to the breach can claim up to $25,000 with third-party receipts or statements. California residents can stack an additional up to $100 on top.

Do I need a lawyer to file a Flagstar settlement claim? 

No. Class counsel — John Yanchunis of Morgan & Morgan and Norman Siegel of Stueve Siegel Hanson LLP — represents all class members at no charge. You can file your claim directly at flagstarsettlement.com without hiring your own attorney. If you choose separate legal representation, that cost is yours to bear.

What if I do nothing about the Flagstar settlement?

 If you do nothing, you receive no money and no credit monitoring — but you also give up your right to sue Flagstar over the 2021 breaches. Doing nothing is the worst outcome: you get no benefit and waive your legal rights. Filing even the simple residual cash claim takes about 5 minutes.

When will I receive my Flagstar settlement payment?

 The court holds its final approval hearing on October 1, 2026. If the judge approves the settlement and no appeals are filed, payments go out as soon as claims are fully processed. If there are appeals, distribution could extend into 2027 or beyond. All checks expire 90 days after issuance — cash yours promptly.

What personal information was exposed in the Flagstar breaches?

 The breaches exposed names, Social Security numbers, addresses, phone numbers, dates of birth, and financial account information. This is the type of data used for personal data stolen settlement claims — it enables identity theft, fraudulent account openings, and financial fraud for years after the initial exposure.

Is the Flagstar settlement website legitimate?

 Yes. The official settlement website is flagstarsettlement.com, authorized by the U.S. District Court for the Eastern District of Michigan. The court-appointed administrator is reachable at 1-855-542-0397 or [email protected]. Do not submit personal information to any other website claiming to be associated with this settlement.

Sources & References

• Official settlement notice (court-approved): flagstarsettlement.com/wp-content/uploads/2026/05/Flagstar_Long-Form-Notice.pdf
• Official claim form: flagstarsettlement.com/wp-content/uploads/2026/05/Flagstar_Claim-Form.pdf
• Official settlement website and FAQ: flagstarsettlement.com
• Law360: Angus et al. v. Flagstar Bank — Preliminary Approval Granted, February 20, 2026
• National Mortgage News: Flagstar agrees to $31.5 million data breach settlement, November 2025

Prepared by the AllAboutLawyer.com Editorial Team and reviewed for factual accuracy against the official court-approved settlement notice and flagstarsettlement.com on May 16, 2026. Last Updated: May 16, 2026

Disclaimer: This article is for informational purposes only and does not constitute legal advice. Legal claims and outcomes depend on specific facts and applicable law. For advice regarding a particular situation, consult a qualified attorney.

All verified facts:

• Case: Angus, et al. v. Flagstar Bank, N.A., Case No. 2:21-cv-10657-MFL-DRG, U.S. District Court, Eastern District of Michigan, before Judge Matthew F. Leitman
• Settlement fund: $31,500,000
• Preliminary approval: February 20, 2026
• Class size: ~2,187,170 U.S. consumers (including ~364,000 California residents)
• Two breaches: January 2021 (Accellion FTA platform, ~1.47M people) and December 2021 (Flagstar’s internal network, ~1.58M people)
• Data exposed: Names, Social Security numbers, addresses, phone numbers, dates of birth, financial account information
• Claim deadline: August 11, 2026
• Opt-out/objection deadline: June 29, 2026
• Final approval hearing: October 1, 2026 at 9:30 a.m. ET via Zoom
• Benefits (all stackable):
  • Documented monetary losses: up to $25,000 (with third-party documentation)
  • Residual cash payment: estimated ~$60, max $599 (no proof needed)
  • California statutory payment: up to $100 (CA residents only, attestation required)
  • Credit monitoring: 3 years, three-bureau (IDX), includes $1M identity theft insurance, dark web monitoring, identity restoration
• Payment options: Venmo, Zelle, PayPal, or paper check
• Attorney fees: up to $10,500,000 + up to $500,000 costs
• Service awards: up to $2,500 per class representative
• Class counsel: John Yanchunis (Morgan & Morgan Complex Litigation Group) and Norman Siegel (Stueve Siegel Hanson LLP)
• Administrator: Flagstar Settlement Administrator, P.O. Box 4427, Baton Rouge, LA 70821 | 1-855-542-0397 | [email protected]
• Official website: flagstarsettlement.com
• SEC penalty: $3.55 million civil money penalty for misleading disclosures (separate, December 2024)
• Accellion context: Flagstar was one of ~300 companies still using Accellion FTA after warnings; cybercriminals posted 80GB of data on dark web in March 2021