OneMain Financial Data Breach Lawsuit, Were You Affected? — Fedorchak v. OneMain Financial Group, LLC, No. 1:26-cv-03845

If OneMain Financial sent you a data breach notice, a proposed class action may involve your information, but no class exists yet and nobody has a claim to file. The suit, Fedorchak v. OneMain Financial Group, LLC, No. 1:26-cv-03845, was filed September 29, 2026 in the U.S. District Court for the District of Maryland. Here’s how to tell if you’re part of the OneMain Financial data breach lawsuit, and what to save.

OneMain Financial Data Breach Lawsuit — Key Facts

Detail	What we know
Lawsuit Filed	September 29, 2026 (Filing 1, Complaint)
Plaintiff	Cari Fedorchak
Defendant	OneMain Financial Group, LLC
Alleged Harm	Exposure of customers’ personal information in a May 2026 data breach. Reports of the complaint say the data included unencrypted names, addresses and Social Security numbers
Law Alleged	The complaint hasn’t been reviewed for this article. Reports mention negligence and related claims. The docket lists 28 U.S.C. § 1332 as the basis for federal jurisdiction, which explains why the case is in federal court, not what it claims
Who Is Affected	No class has been defined. People whose information was involved in the incident OneMain reported to state regulators
Court & Case Number	U.S. District Court, District of Maryland, No. 1:26-cv-03845
Judge	Julie Rebecca Rubin at filing; a docket summary reports reassignment to Judge Adam B. Abelson on October 1, 2026
Plaintiff’s Counsel	Jeff Ostrow (listed on the docket)
Current Stage	Early stage. Complaint filed and judge assigned
Lead Plaintiff Deadline	Not applicable (consumer case)
Settlement Status	None reported as of October 5, 2026
Docket Last Checked	October 5, 2026
Last Updated	October 5, 2026

Who Is OneMain Financial and Why Is It Being Sued?

OneMain Financial Group, LLC is a consumer lender that offers personal installment loans. Borrowers give it personal details such as names, addresses and Social Security numbers to apply, so it holds sensitive records. The company’s own annual report says it’s subject to the federal Gramm-Leach-Bliley Act and New York’s cybersecurity rule for financial companies, both of which expect it to protect customer data. The new suit alleges it didn’t do so adequately.

What Did OneMain Report About the May 2026 Data Breach?

California’s attorney general lists OneMain Financial Group, LLC in its public breach registry with incident dates of May 5 and May 8, 2026. OneMain reported it there on September 25, 2026, more than four months after the second date. Reports say notice letters began going out around September 28, 2026.

State filings reported in the press show affected residents in several states: 15,472 in Texas, 1,516 in South Carolina and 960 in Oregon. Those are state-level counts, not a nationwide total. One third-party site lists a figure of 122,783 people, but we couldn’t confirm it from any official source, so we don’t use it.

OneMain hasn’t publicly said how the incident happened or who was responsible, according to the reports we reviewed. Reports say OneMain is offering affected people 24 months of free credit monitoring through TransUnion, with an enrollment deadline reported as December 31, 2026. Check your own letter for the real terms.

What Does the Lawsuit Say?

Cari Fedorchak filed the complaint on September 29, 2026 and demanded a jury trial, according to the docket. We haven’t reviewed the complaint itself. Reports that summarize it say it alleges:

• OneMain failed to use reasonable security, including not encrypting customer data
• OneMain didn’t adequately monitor its systems and kept data longer than necessary
• OneMain didn’t notify affected people promptly
• The exposed information put class members at greater risk of identity theft and fraud

The reported claims include negligence, negligence per se, breach of implied contract and unjust enrichment. The plaintiff reportedly seeks damages, court orders requiring stronger security, and long-term credit monitoring for affected people.

These are allegations, not findings. OneMain hasn’t been found responsible, and no response from the company appears on the docket we reviewed.

Another suit may exist. A related complaint, Harris v. OneMain Financial Group, LLC, was reportedly filed in the same court on September 28, 2026. We haven’t reviewed it, and we don’t know whether the cases will be combined.

There’s context, too. OneMain’s annual report says it agreed in 2023 to pay a $4.25 million civil penalty under a consent order with the New York Department of Financial Services, tied mainly to a review of its cybersecurity policies. No one has alleged that order is connected to this breach, and it proves nothing about this incident.

Related article: Aldi SNAP,EBT Pricing Lawsuit Dismissed, What It Alleged and What Happens Next — La Tour II v. Aldi Foods, Inc., No. 2:26-cv-08737

Are You Part of the OneMain Financial Data Breach Lawsuit?

Nobody is officially in or out yet, because no class has been certified. Based on what’s been reported, you may be affected if:

• You received a data breach notice from OneMain that refers to a May 2026 incident
• Your letter lists the types of information involved, such as your name, address or Social Security number
• You had a loan, application or account with OneMain when the incident happened

You likely aren’t affected if you never dealt with OneMain, or if your only OneMain notice is about a different, older incident. California’s registry lists a separate 2022 OneMain notice involving a vendor.

Check the date and incident named on your letter. If it names a May 2026 incident, this is the case to watch.

OneMain Customers Outside Maryland — Are You Still Covered?

The case is in a Maryland federal court, but that doesn’t limit who a class could include. Affected people live in several states, and reports say the plaintiff seeks a nationwide class. Whether the court ever certifies one is undecided, so check the class definition if one is proposed.

Can Heirs, Businesses, or Households Be Part of the Lawsuit?

No class has been defined and no court notice has gone out, so there’s no official answer. If a borrower has died, don’t assume an estate or heir can step in. The rules differ, and any notice will explain. Co-borrowers each have their own information at stake, so each should check for their own letter. If you’ve moved since your loan, your notice may have gone to an old address, so ask OneMain whether your data was involved.

Not sure if you’re part of the OneMain Financial data breach lawsuit? A free consultation with a data privacy attorney can help you understand your options.

What Is the Plaintiff Asking the Court to Award?

The docket confirms only a jury demand. Reports say the plaintiff seeks damages, restitution and orders requiring OneMain to improve its data security. No dollar amount has been reported.

No money yet. No claim form yet.

What Could OneMain Customers Receive If This Settles?

Nobody can say. It depends on whether a class is certified, what harm can be shown, and what OneMain and the plaintiffs negotiate. The credit monitoring in your notice is a separate offer from the company, not a payment from this case. Data breach settlements that reach final approval often provide credit monitoring, modest cash payments, or both, but nothing is guaranteed.

Any dollar figure you see for this case right now is a guess.

What Should OneMain Customers Do Right Now?

1. Don’t look for a sign-up. There isn’t one, and there’s no claim form. If a class is certified later, members are generally included automatically.
2. Keep your notice letter and envelope. Note the date, the types of information it lists, and any deadline to enroll in credit monitoring.
3. Use the monitoring offer carefully. Enroll only through the instructions in your own letter or an official OneMain communication.
4. Protect your credit now. Order your free credit reports at AnnualCreditReport.com. Consider a security freeze, which is free under federal law and blocks new accounts in your name. A fraud alert is also free. The FTC’s IdentityTheft.gov/databreach gives steps based on what was exposed.
5. Watch your accounts and your inbox. Check statements for unfamiliar charges. Be wary of emails, texts or calls claiming to be OneMain or a credit bureau that ask for passwords or your Social Security number.
6. Write down any losses. Save statements, screenshots of unfamiliar accounts, and a log of time spent sorting it out.
7. Watch the docket. Search Fedorchak v. OneMain Financial Group, LLC, No. 1:26-cv-03845, on CourtListener or PACER.
8. Know your individual options. Loan agreements sometimes include dispute terms, so a data privacy attorney should read yours. Time limits apply to any claim.

Plenty of websites invite you to “join” data breach suits. Those are usually law firm intake forms, not court sign-ups. Don’t give your Social Security number to anyone you haven’t verified.

A security freeze costs nothing and works whether or not the lawsuit goes anywhere.

Does the Breach Mean Your Identity Was Stolen?

Not necessarily. A breach means information was accessed without permission. It doesn’t prove your information was misused. The lawsuit alleges the exposure raises the risk of identity theft and fraud. That risk is why the free steps above are worth taking.

OneMain Financial Data Breach Lawsuit — Full Timeline

Date	Event	Source
May 5 and May 8, 2026	Incident dates listed for OneMain Financial Group, LLC	California Attorney General breach registry
September 25, 2026	OneMain’s breach reported to California	California Attorney General breach registry
Around September 28, 2026	Notice letters reportedly begin to go out	Press reports
September 28, 2026	Harris v. OneMain Financial Group, LLC reportedly filed in D. Md.	CourtListener/RECAP, not reviewed
September 29, 2026	Fedorchak complaint filed; case assigned to Judge Rubin	Federal docket
September 30, 2026	Summons issued	PACER Monitor docket summary
October 1, 2026	Case reportedly reassigned to Judge Abelson	PACER Monitor docket summary
None reported as of October 5, 2026	OneMain’s response to the complaint
None reported as of October 5, 2026	Class certification
None reported as of October 5, 2026	Settlement

OneMain Financial Data Breach Lawsuit — Frequently Asked Questions, No. 1:26-cv-03845

Is there a class action against OneMain Financial right now?

 Yes, a proposed class action, Fedorchak v. OneMain Financial Group, LLC, was filed September 29, 2026 in the District of Maryland. No class has been certified, so no one is officially a class member yet. A second suit, Harris, was reportedly filed the day before.

What information was exposed in the OneMain breach? 

Reports and the lawsuit say names, addresses and Social Security numbers. Your notice letter is the best source for what applies to you.

Do I need to do anything to be part of the OneMain class action? 

No. There’s no sign-up and no claim form. Keep your notice letter, since it connects you to the May 2026 incident.

Is there a OneMain Financial settlement? 

No. There’s no settlement fund, administrator, claim form or deadline.

When will the case settle? 

Nobody can say. Data breach cases can take years, and some end without a payout.

Can I file my own lawsuit against OneMain instead? 

You may have that option, but it’s a legal decision. Time limits apply, and your loan agreement may contain terms about disputes. A data privacy attorney can read it and explain.

How will I find out if OneMain settles? 

Class members would get a court-approved notice, typically by mail or email. Reach any claim site through that notice or the court docket, never through an ad or unsolicited text.

Has OneMain been found responsible?

 No. The case is new, and the allegations haven’t been decided.

What does “lead plaintiff” mean here? 

Cari Fedorchak is the named plaintiff. Formal lead plaintiff deadlines mainly arise in securities cases, and none applies to this consumer case.

What laws does OneMain allegedly violate? 

The complaint hasn’t been reviewed for this article. Reports mention negligence, negligence per se, breach of implied contract and unjust enrichment.

How much could class members get if it settles? 

No amount is set and no class has been certified.

Sources Used in This OneMain Financial Data Breach Article

• Court docket — Fedorchak v. OneMain Financial Group, LLC, No. 1:26-cv-03845 (D. Md.), Filing 1 (Complaint) and case assignment, September 29, 2026, Justia mirror of PACER, last retrieved September 29, 2026: https://dockets.justia.com/docket/maryland/mddce/1:2026cv03845/614975
• Docket summary — Fedorchak v. OneMain Financial Group, LLC, PACER Monitor (source for the September 30 summons and October 1 reassignment): https://www.pacermonitor.com/public/case/67059276/FEDORCHAK_v_ONEMAIN_FINANCIAL_GROUP,_LLC
• Related complaint — Harris v. OneMain Financial Group, LLC (D. Md.), CourtListener/RECAP: https://storage.courtlistener.com/recap/gov.uscourts.mdd.614498/gov.uscourts.mdd.614498.1.0.pdf
• California Attorney General — “Search Data Security Breaches,” OneMain Financial Group, LLC entry, incident dates May 5 and 8, 2026, reported September 25, 2026: https://oag.ca.gov/privacy/databreach/list
• News and breach reports — teiss, “OneMain Financial discloses data breach affecting thousands across multiple states”: https://www.teiss.co.uk/news/onemain-financial-discloses-data-breach-affecting-thousands-across-multiple-states-18245
• Breach report — Emery Reddy, OneMain Financial data breach page (state-level counts as reported): https://www.emeryreddy.com/blog/data-breach/onemain-financial-data-breach
• SEC — OneMain Holdings, Inc., Form ARS for fiscal 2023 (Gramm-Leach-Bliley Act, NYDFS cybersecurity regulation and 2023 consent order): https://www.sec.gov/Archives/edgar/data/1584207/000110465924052930/tm244646d2_ars.pdf
• Government source — Federal Trade Commission, IdentityTheft.gov/databreach
• Complaint and notice letter — Fedorchak complaint and OneMain’s notice letter: not reviewed

Researched and written by Israr Ahmad, legal content researcher and founder of AllAboutLawyer.com. Facts checked against the California Attorney General’s breach registry, the federal docket for the District of Maryland as mirrored by Justia, a docket summary, OneMain Holdings’ SEC filing and press reports on October 5, 2026. The complaint and OneMain’s notice letter were not reviewed. We’ll update this article when we’ve reviewed them. Last Updated: October 5, 2026.

Disclaimer: This article is for informational purposes only and does not constitute legal advice. Laws vary by state and individual circumstances differ. For advice about your specific situation, consult a qualified attorney.