OneMain Financial Lawsuit Update 2026, 13 States Allege Hidden Loan Add-Ons, $20 Million CFPB Order and New Data Breach Cases

Excerpt: OneMain Financial is facing a multistate lawsuit accusing the lender of selling borrowers expensive credit insurance and optional products without clearly explaining their costs or obtaining informed consent. Filed March 16, 2026 by attorneys general from 13 states, it follows a $20 million CFPB order in 2023. OneMain has moved to dismiss and discovery is stayed. Separate data-breach class actions are also pending.

Last Updated: November 6, 2026 | Written by: Israr Ahmad

OneMain Financial faces several different legal disputes, not just one lawsuit. They involve its consumer lending practices, optional loan products and customer data security.

The biggest case began on March 16, 2026, when attorneys general from 13 states sued OneMain Holdings and related companies in federal court. They accuse the lender of steering borrowers into expensive credit insurance and membership products. The states allege loans were advertised on clear terms, then loaded with costly add-ons during closing that borrowers were not told were optional, and that some were charged for products they declined.

OneMain denies the allegations. It says the lawsuit tries to revive issues already addressed in a 2023 Consumer Financial Protection Bureau (CFPB) order and challenges conduct tied to its compliance with that order. The case is in the U.S. District Court for the Southern District of New York. OneMain moved to dismiss in June 2026, the states opposed it and the judge stayed discovery while considering the motion.

The company also has a history. The CFPB ordered $10 million in consumer redress and a $10 million civil penalty in 2023, a separate New York regulator action produced a $4.25 million cybersecurity penalty the same year, and multiple proposed class actions were filed in Maryland after a May 2026 data-security incident.

These proceedings are legally distinct. The 13-state lending case is not a data-breach lawsuit, the 2023 CFPB order is not a class settlement, and the data-breach complaints have not been certified as class actions.

All claims described are allegations unless a regulator or court has made a finding, and OneMain’s defenses are included throughout.

Quick Facts: OneMain Financial Lawsuit

Detail	Latest information
Main case	People of the State of New York et al. v. OneMain Holdings, Inc. et al.
Court	U.S. District Court, Southern District of New York
Case number	1:26-cv-02117
Judge	Paul A. Engelmayer
Filed	March 16, 2026
Plaintiffs	Attorneys general from 13 states
Defendants	OneMain Holdings and related OneMain entities
Main allegations	Hidden add-on products, deceptive lending, unauthorized charges, misleading disclosures
OneMain’s position	Denies the allegations; will defend the case
Motion to dismiss	Filed June 1, 2026
States’ opposition	Filed June 22, 2026
Discovery	Stayed July 14, 2026
Oral argument	July 21, 2026
Latest public docket entry located	September 10, 2026
Ruling on dismissal	None located as of November 6, 2026
2023 CFPB order	20milliontotal(10M redress, $10M penalty)
2023 NYDFS penalty	$4.25 million (cybersecurity)
Data-breach litigation	Multiple proposed class actions, District of Maryland, from late September 2026
Consumer payout from the 2026 state case	None established
Global settlement	None publicly confirmed

What Is the OneMain Financial Lawsuit About?

OneMain is one of the largest non-bank installment lenders in the United States, with more than 1,300 branches in roughly 44 states, serving mostly subprime and near-prime borrowers. It operates through several related companies.

The 13-state complaint is about how OneMain marketed and sold additional products to people taking out personal loans. The states argue the products were often presented so that borrowers believed they were required for approval, a better rate or the advertised terms, and that they appeared near the end of the closing process. The states call this a bait-and-switch scheme.

Which Products Are at the Center of the Case?

• Credit insurance: credit life, credit disability, involuntary unemployment and Guaranteed Asset Protection (GAP) products. GAP generally covers the gap between what is owed on qualifying vehicle financing and the vehicle’s value after a covered total loss, subject to the contract.
• Non-credit insurance and membership products: Auto Plus, Home and Auto membership products, Silver Safeguard, identity-protection services and other lifestyle, health and membership offerings, described in some reports as similar to roadside assistance or discount clubs, plus term life insurance.

Offering optional insurance or memberships is not unlawful in itself. The lawsuit alleges OneMain failed to make sure borrowers understood the products, their costs and that they could refuse them.

Which 13 States Are Suing?

New York Attorney General Letitia James led a bipartisan coalition: New York, Pennsylvania, Colorado, Maryland, Nevada, New Hampshire, New Jersey, North Dakota, Oklahoma, South Dakota, Virginia, Washington and Wisconsin.

The case is brought by the states, not by individual consumers as a class action. The defendants named include OneMain Holdings, Inc., OneMain Finance Corporation, OneMain Consumer Loan, Inc., OneMain Financial Holdings LLC, OneMain Financial Group LLC and OneMain Financial, Inc. The states allege the named companies took part in or benefited from the challenged practices. These allegations have not been proven.

What Do the States Allege?

The Closing Process

The states say borrowers applied online or at a branch and discussed the amount and monthly payment, but the add-ons were introduced late. They allege digital closings involved documents of up to about 50 pages, with employees controlling or advancing the presentation so customers could not review details at their own pace.

“Required” or Optional?

The complaint alleges some employees communicated or implied that products were required for approval or favorable terms, and that customers were not clearly told they could refuse without losing the loan. It also alleges employees were trained to keep pitching after a customer said no.

The Cost

The states allege the add-ons added hundreds or thousands of dollars per borrower and generated hundreds of millions of dollars in extra revenue for OneMain. Because add-on premiums are often financed, borrowers can pay interest on them too. As a hypothetical, a $5,000 loan with $1,500 of financed add-ons could mean paying interest on $6,500. That example is illustrative and not an allegation about a specific customer.

Commissions and Incentives

The complaint alleges employees could earn roughly 5% to 6% commission on certain non-credit insurance products, with overrides for branch managers and further compensation for district managers. Commissions are lawful, but the states argue these incentives encouraged misleading sales. OneMain has not admitted that its compensation practices were unlawful.

Refinancing

The states argue refinancing gave repeated chances to add products to new loans, growing borrowers’ debt. The complaint does not claim that every refinance was improper.

Colorado GAP Insurance

Colorado alleges that OneMain shifted from GAP waivers to GAP insurance in October 2021, with an average premium of about $1,149.72 and some policies costing up to $6,326.08. It also alleges some contracts exceeded a 150% loan-to-value limit that took effect January 1, 2024, and that about 63% of relevant Colorado loans in 2024 exceeded it. That does not mean every Colorado GAP contract was unlawful.

Washington’s allegations focus on closing procedures and unclear disclosure of the optional nature and cost of products. Washington and Colorado both seek restitution, penalties and changes in practice.

The 2023 CFPB Enforcement Order

On April 27, 2023 the CFPB announced an order against OneMain Financial Holdings and related companies. It found deceptive and unfair practices involving credit insurance and other optional products:

1. Consumers were misled into thinking certain products were required for loans or better rates.
2. Consumers were told they could cancel within a refund period without financial consequence, but did not receive full refunds of premiums and related interest in some situations.
3. OneMain kept about $10 million in interest that should have been refunded to about 25,000 consumers.

Component	Amount
Consumer redress	$10 million
Civil money penalty	$10 million
Total	$20 million

The order also extended the full-refund cancellation period for certain products from 30 to 60 days and imposed compliance and monitoring obligations.

Is the CFPB Order the Same as the 2026 Lawsuit?

No. The CFPB case was a separate federal administrative proceeding. The 2026 case is brought by 13 states and alleges broader conduct under federal and state laws. OneMain uses the 2023 order in its defense, arguing the states are relitigating addressed conduct. The states say the new case involves additional and continuing conduct and independent enforcement authority. The court has not resolved this.

OneMain’s Defense and Motion to Dismiss

OneMain’s public position is that the allegations are “simply untrue” and wrong on the facts and the law. Its June 1, 2026 motion asks the court to dismiss the case in whole or substantial part, on four main grounds:

1. The 2023 CFPB order already addressed relevant conduct. OneMain invokes claim preclusion and the finality of earlier proceedings.
2. The states cannot challenge compliance with the CFPB order. Conduct required or approved under the order, the company argues, should not support a new action.
3. The states exceed their authority on the federal claims. OneMain raises the authority of state attorneys general under the Consumer Financial Protection Act, the geographic scope of federal claims, venue in the Southern District of New York and how Truth in Lending Act (TILA) enforcement fits the pleaded claims.
4. Some state claims lack a sufficient basis. OneMain argues that particular states cannot establish the required jurisdictional or factual basis for the relief requested.

These are legal arguments, not findings. Such motions are typically brought under Federal Rule of Civil Procedure 12 (including 12(b)(6) for failure to state a claim and 12(b)(3) for improper venue). The states argue their allegations meet every requirement.

Where the Case Stands: June to November 2026

Date	Development
March 16, 2026	Thirteen states file the lawsuit
June 1, 2026	OneMain files motion to dismiss and asks to stay discovery
June 2, 2026	Court sets deadline for plaintiffs to amend or oppose
June 22, 2026	States file opposition
July 6, 2026	OneMain files reply
July 14, 2026	Judge Paul A. Engelmayer stays discovery
July 21, 2026	Oral argument
July 24, 2026	OneMain asks to seal compliance-related materials
July 30, 2026	Court grants sealing request
September 10, 2026	Latest entry in the public docket mirror reviewed
November 6, 2026	No ruling on the motion to dismiss located

The Discovery Stay

Discovery is when parties exchange documents and take depositions. The July 14 stay pauses it while the court decides the dismissal motion. It does not dismiss the case, and it preserved the plaintiffs’ ability to ask to lift the stay after oral argument.

Oral Argument and Sealed Materials

At the July 21 hearing the court addressed the dismissal arguments and asked about OneMain’s compliance with the 2023 CFPB consent order. OneMain then sought to seal its compliance plan and a related CFPB non-objection letter, and the court granted that on July 30. Sealing means the documents are not publicly available. It is not a ruling for OneMain on the lawsuit.

Docket mirrors can lag the live federal docket (PACER), so check it before relying on anything after September 10.

The Laws at Issue

Consumer Financial Protection Act (CFPA)

• 12 U.S.C. §5531 lets the CFPB prohibit unfair, deceptive or abusive acts or practices (UDAAP).
• 12 U.S.C. §5536 makes it unlawful for covered persons and service providers to engage in UDAAP.
• 12 U.S.C. §5552 authorizes state attorneys general to bring civil actions to enforce the CFPA’s provisions, generally with prior notice to the CFPB. OneMain’s challenge to the states’ authority goes to how far this provision reaches, including what it means for claims that overlap with the CFPB’s 2023 order.

Truth in Lending Act (TILA) and Regulation Z

TILA (15 U.S.C. §1601 and following) requires disclosure of the annual percentage rate, finance charge, amount financed, total of payments and payment schedule. Under Regulation Z (12 C.F.R. Part 1026), premiums for credit life, accident, health or loss-of-income insurance can be excluded from the finance charge only if conditions are met (12 C.F.R. §1026.4(d)(1); see also 15 U.S.C. §1605(c)). They include disclosing that the coverage is not required and obtaining the consumer’s affirmative written request after getting the required information. Debt cancellation and GAP products have their own conditions under §1026.4(d)(3). Optional products are not automatically unlawful under TILA, and the outcome depends on the contracts and what borrowers were shown.

State Law

• New York Executive Law §63(12): lets the Attorney General seek remedies for repeated fraudulent or illegal acts in business.
• New York General Business Law §§349 and 350: prohibit deceptive acts and false advertising.
• Pennsylvania Unfair Trade Practices and Consumer Protection Law, 73 P.S. §201-1 and following.
• Colorado’s GAP insurance and loan-to-value rules.
• Other states’ consumer-protection and insurance laws, whose standards and remedies differ, which is one reason this is not a single nationwide class action.

Claim Preclusion

OneMain’s lead defense relies on the doctrine that a final judgment bars later claims based on the same conduct. Whether a CFPB consent order can preclude state attorney general claims is a contested question, and the court has not ruled.

What Could the States Win?

The complaint seeks:

1. Restitution for consumers.
2. Civil penalties under applicable laws.
3. Disgorgement of profits.
4. Permanent injunctive relief against the challenged practices.
5. Credit-reporting corrections, removing negative reporting tied to disputed add-on products, and ending related collection activity.
6. Other equitable relief.

No amount has been awarded. A request for relief is not a settlement fund available to every borrower.

Can OneMain Customers Get Money From the Lawsuit?

Not automatically. The March 2026 case is a state enforcement action, not a certified class action. If the states prove their claims, a court could order restitution for qualifying consumers, but no claims process or universal payment amount has been approved. Having a OneMain loan does not by itself qualify someone for compensation. The 2023 CFPB order is a separate matter, and no global settlement of the 13-state case had been publicly confirmed as of November 6, 2026.

What Should OneMain Borrowers Do Now?

1. Review your loan agreement: APR, amount financed, finance charge, monthly payment and total repayment.
2. Look for separate add-on contracts: credit life, disability, unemployment, GAP or membership products.
3. Check whether you actually agreed to each product, including signatures, electronic acceptance records and what you were told.
4. Review cancellation and refund terms. The 2023 order addressed refund practices. Check your insurance certificate and state law for cancellation and refund rights.
5. Keep records: statements, insurance certificates, sales messages and cancellation requests.
6. Dispute inaccurate credit reporting under the Fair Credit Reporting Act (15 U.S.C. §1681 and following) if an add-on charge is being reported incorrectly.
7. File complaints with the CFPB, your state attorney general or your state insurance regulator.
8. Beware of scams: do not pay anyone who promises a guaranteed OneMain payout or special access to an administrator.

Borrowers who are sued by OneMain on defaulted loans face collection actions in state courts. Those are separate from the company-facing litigation described here.

The Separate 2026 Data Breach Litigation

What Happened

In May 2026 OneMain experienced a cybersecurity incident involving unauthorized activity and customer information. A sample breach notice filed with Massachusetts authorities says OneMain discovered unauthorized activity and determined certain information had been accessed or acquired. Reporting gives August 18, 2026 as the discovery date for the activity described in the notice, with customer notices beginning in September 2026, about 146 days after the incident by some accounts. Exposed information reportedly included names, addresses and Social Security numbers, though the exact data varies by person.

OneMain says it found no unauthorized access to customer accounts and had received no reports of fraud or identity theft when the notice was prepared. That does not guarantee no one will experience misuse.

How Many People Were Affected?

State disclosures include 15,472 Texas residents, 1,516 South Carolina residents and 960 Oregon residents. These should not be added together as a nationwide total, and no verified nationwide count was identified.

The Class Actions

Beginning September 28, 2026, at least nine proposed class actions (some reports say 10 or 11) were filed in the U.S. District Court for the District of Maryland, including Harris v. OneMain Financial Group LLC (No. 1:26-cv-03823), Chess (No. 1:26-cv-03826), Fedorchak (No. 1:26-cv-03845), Adams, Velazquez, Longoria, Clayton, Gordon and Delapaz.

They allege inadequate security (such as encryption and deleting unnecessary data) and delayed notice. Depending on the complaint, the claims include negligence, negligence per se, breach of implied contract and unjust enrichment, seeking damages, restitution, credit monitoring and security improvements.

No class has been certified, no liability has been decided and no settlement has been announced. Certification requires satisfying Federal Rule of Civil Procedure 23. Courts handle overlapping cases through consolidation (Rule 42) and by appointing interim class counsel (Rule 23(g)). In an October 23 docket development, the court granted an unopposed stay in the Delapaz matter while consolidation and leadership issues were addressed.

Laws Relevant to the Breach Cases

• Gramm-Leach-Bliley Act (15 U.S.C. §6801) and the FTC Safeguards Rule (16 C.F.R. Part 314): require non-bank financial institutions to safeguard customer information. There is generally no private right of action under these rules, so the class actions rely on state-law theories.
• State breach-notification and data-security laws, such as Maryland’s Personal Information Protection Act, which sets requirements for security and for timely notice. Notification timing is likely to be a point of dispute in the delay allegations.
• Article III standing: under TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), plaintiffs need a concrete injury, and courts examine whether risk of identity theft or mitigation costs are enough, an issue that often decides data-breach cases early.

Is There a Claim Form or Free Credit Monitoring?

No court-approved class settlement or claim form was identified as of November 6, 2026. OneMain’s own notice offered eligible recipients 24 months of credit monitoring and identity-restoration services through TransUnion, administered by Cyberscout, with an enrollment deadline of December 31, 2026. That is a security response, not a class settlement.

The 2023 New York Cybersecurity Penalty

On May 24, 2023 the New York Department of Financial Services (NYDFS) announced a $4.25 million penalty against OneMain Financial Holdings, LLC after an examination. It identified deficiencies in cybersecurity governance, third-party service-provider security, application security, access privileges and risk management, and required corrective measures under NYDFS’s cybersecurity regulation (23 NYCRR Part 500).

This action is separate from the CFPB order, the 13-state lending case and the 2026 breach litigation. The earlier order does not prove the 2026 breach was caused by the same failures.

Timeline: 2023 to November 2026

Date	Development
April 27, 2023	CFPB announces $20 million order on deceptive add-on practices
May 24, 2023	NYDFS announces $4.25 million cybersecurity penalty
March 16, 2026	13 states file the lending lawsuit
May 2026	Data-security incident occurs
June 1, 2026	OneMain files motion to dismiss and asks to stay discovery
June 22, 2026	States oppose dismissal
July 6, 2026	OneMain files reply
July 14, 2026	Discovery stayed
July 21, 2026	Oral argument
July 30, 2026	Sealing request granted
August 18, 2026	OneMain discovers the unauthorized activity described in its breach notice
September 10, 2026	Last entry in the public docket mirror reviewed for the lending case
September 25 to 28, 2026	Breach notices and state disclosures become public
September 28 to October 2, 2026	Proposed data-breach class actions filed in Maryland
October 23, 2026	Delapaz stay granted while consolidation and leadership issues are addressed
November 6, 2026	No ruling on the motion to dismiss and no settlement confirmed

Frequently Asked Questions

Is OneMain Financial being sued in 2026?

Yes. Attorneys general from 13 states sued OneMain on March 16, 2026 over alleged deceptive sales of credit insurance and other loan add-ons.

Why are 13 states suing?

They allege OneMain misled borrowers about whether add-ons were optional, failed to explain their costs and charged some consumers for products they did not knowingly authorize.

Has OneMain admitted wrongdoing?

No. It disputes the allegations and says the case revisits matters addressed by its 2023 CFPB order.

Has the lawsuit been dismissed?

No dismissal ruling was located as of November 6, 2026. The motion to dismiss is pending and discovery is stayed.

Is it a class action?

The 13-state case is not. Separate proposed class actions concern the May 2026 data breach.

How much money could borrowers receive?

Nothing has been approved. The states seek restitution, penalties and other relief, but eligibility and amounts are undetermined.

Did OneMain already pay $20 million?

Yes, under the CFPB’s 2023 order ($10 million redress and $10 million penalty). That case is separate from the 2026 state lawsuit.

What was the $4.25 million penalty?

A May 2023 NYDFS cybersecurity penalty, separate from the lending allegations.

Did OneMain have a data breach in 2026?

Yes. The company reported unauthorized activity involving customer information tied to a May 2026 incident, and proposed class actions followed.

Can I join the data-breach lawsuit?

Proposed class actions have been filed, but no class has been certified and no settlement or claim form exists as of November 6, 2026.

What information was exposed?

Reports indicate names, addresses and Social Security numbers may have been involved, depending on the person.

Does OneMain offer free credit monitoring?

Its notice offered 24 months through TransUnion, administered by Cyberscout, with a December 31, 2026 enrollment deadline. It is not a class settlement.

Can I cancel optional insurance on my loan?

It depends on the product, contract and state law. The 2023 order addressed cancellation and refund practices, so review your certificate and cancellation terms.

Are all OneMain loans illegal?

No. The lawsuit challenges specific alleged sales and disclosure practices.

Does having a OneMain loan qualify me for a refund?

No. Any restitution would depend on a court order or settlement process.

When will the case be decided?

No trial date or merits decision has been announced. The next step is the ruling on the motion to dismiss.

The Bottom Line

OneMain’s legal problems go beyond one lawsuit. The 13-state case accuses the company of selling expensive add-ons through deceptive closings, follows a $20 million CFPB order, and is being contested through a motion to dismiss with discovery stayed. Separately, nine or more proposed class actions over the May 2026 data incident are at the pleading stage. There is currently no universal OneMain payout, no approved claims form for the lending case and no certified class or settlement in the breach cases. Borrowers who think they were charged for products they did not authorize should keep their contracts, statements and communications and watch for the ruling on the dismissal motion and the consolidation of the breach cases.

Related AllAboutLawyer Coverage

• OneMain Financial Data Breach Lawsuit, Were You Affected? Fedorchak v. OneMain Financial Group, LLC, No. 1:26-cv-03845: 
• TurboTax Advertised Your Refund Advance as “0% Interest.” A New Lawsuit Says Service Members Were Charged Far More Than That 
• Navy Federal Credit Union Settlement, Check If You Qualify, Edey v. NFCU, No. 2:25-cv-554 

Sources and Court Records

Main 13-state lending case

1. New York Attorney General, “Attorney General James Leads Bipartisan Coalition Suing Predatory Lender OneMain,” March 16, 2026. https://ag.ny.gov/press-release/2026/attorney-general-james-leads-bipartisan-coalition-suing-predatory-lender-onemain
2. Complaint, People of the State of New York et al. v. OneMain Holdings, Inc. et al., filed March 16, 2026. https://ag.ny.gov/sites/default/files/court-filings/new-york-et-al-v-onemain-holdings-inc-complaint-2025.pdf
3. Docket, Case No. 1:26-cv-02117 (S.D.N.Y.). https://dockets.justia.com/docket/new-york/nysdce/1:2026cv02117/659723
4. OneMain’s memorandum of law supporting its motion to dismiss, June 1, 2026. https://business.cch.com/BFLD/OneMain-Holdings-Law-Memorandum-Support-MTD-Motion-Strike-ECF-103-06012026060326.pdf
5. Order on motion to stay discovery, July 14, 2026. https://docs.justia.com/cases/federal/district-courts/new-york/nysdce/1:2026cv02117/659723/118
6. Washington Attorney General, “AG Brown sues OneMain Financial over alleged bait-and-switch lending scheme.” https://www.atg.wa.gov/news/news-releases/ag-brown-sues-onemain-financial-alleged-bait-and-switch-lending-scheme
7. Colorado Attorney General, “Weiser sues OneMain Financial.” https://coag.gov/press-releases/weiser-sues-onemain-financial/
8. Maryland Attorney General, OneMain add-on products lawsuit announcement. https://oag.maryland.gov/News/pages/Attorney-General-Brown-Sues-One-Main-Financial-for-Alleged-Bait-and-Switch-Lending-Scheme-Involving-Hidden-Add-On-Products.aspx
9. Reuters, “OneMain sued by U.S. states over selling hidden add-on products and collecting junk fees,” March 16, 2026. https://www.reuters.com/world/onemain-sued-by-us-states-selling-hidden-add-on-products-collecting-junk-fees-2026-03-16/

Earlier enforcement

10. CFPB, OneMain Financial enforcement action. https://www.consumerfinance.gov/enforcement/actions/onemain-financial-holdings-llc-et-al/
11. CFPB, “CFPB Orders Installment Lender OneMain to Pay $20 Million for Deceptive Sales Practices,” April 27, 2023. https://www.consumerfinance.gov/archive/newsroom/cfpb-orders-installment-lender-onemain-to-pay-20-million-for-deceptive-sales-practices/
12. NYDFS, OneMain Financial Holdings cybersecurity consent order, May 24, 2023. https://www.dfs.ny.gov/industry_guidance/enforcement_discipline/ea20230524_co_onemain

Data-breach litigation

13. OneMain sample breach notice filed with the Massachusetts Attorney General. https://www.mass.gov/doc/2026-1642-onemain-financial-group-llc/download
14. Harris v. OneMain Financial Group LLC, No. 1:26-cv-03823; Chess, No. 1:26-cv-03826; Fedorchak, No. 1:26-cv-03845 (D. Md.). https://www.courtlistener.com/
15. Oregon Department of Justice, data breach notifications. https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/data-breach-notifications/

Laws, rules and cases

16. Consumer Financial Protection Act, 12 U.S.C. §§5531, 5536 and 5552. https://uscode.house.gov/
17. Truth in Lending Act, 15 U.S.C. §§1601 and 1605; Fair Credit Reporting Act, 15 U.S.C. §1681; Gramm-Leach-Bliley Act, 15 U.S.C. §6801. https://uscode.house.gov/
18. Regulation Z, 12 C.F.R. Part 1026; FTC Safeguards Rule, 16 C.F.R. Part 314. https://www.ecfr.gov/current/title-12/chapter-X/part-1026
19. New York Executive Law §63(12); New York General Business Law §§349 and 350; Pennsylvania UTPCPL, 73 P.S. §201-1; Maryland Personal Information Protection Act; 23 NYCRR Part 500.
20. Federal Rules of Civil Procedure 12, 23 and 42; TransUnion LLC v. Ramirez, 594 U.S. 413 (2021).

Research and verification note: The state complaint, OneMain’s motion to dismiss, the states’ opposition, the discovery-stay order and available docket entries were reviewed. The public docket mirror shows September 10, 2026 as its latest entry, so a later PACER filing may exist, and no ruling on the motion to dismiss was identified as of November 6. The “hundreds of millions in extra revenue” allegation, the breach discovery and notification timing, the number of Maryland cases and the Chess case number come from reporting and should be checked against the dockets. The statutory references added to this article (including CFPA §5552, the Safeguards Rule and Maryland’s data law) should be confirmed against current text before publishing. The data-breach complaints are described as proposed class actions, not certified classes.

About the Author: Researched and written by Israr Ahmad using state attorney general complaints, federal court filings, CFPB enforcement records, regulatory orders and consumer lending laws.

Disclaimer: This article is for informational purposes only and is not legal advice. AllAboutLawyer.com is a legal information website, not a law firm. Allegations in the 2026 lawsuit have not been established by a final court judgment. Earlier CFPB and NYDFS actions are separate proceedings.