People whose information was involved in the Fiesta Insurance data security incident discovered in June 2025 may be covered by a consolidated proposed class action alleging Fiesta Insurance Franchise Corporation failed to protect names, Social Security numbers, passport numbers and financial account information. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes class action complaints. The statements below are unproven allegations. Fiesta Insurance Franchise Corporation has not admitted wrongdoing and has not been found liable, there is no certified class, and there is nothing to claim at this time. This page is informational. It is not legal advice.
What the Fiesta Insurance Lawsuits Are About
Fiesta Insurance Franchise Corporation, which does business as Fiesta Insurance, runs a multi-state franchise network of local storefronts. According to the first complaint filed against it, those storefronts broker insurance policies from third-party carriers and also offer tax-preparation services. The company is incorporated in Delaware and headquartered in Las Vegas.In a notice posted on its website, Fiesta Insurance says it learned on June 9, 2025 that systems in its network had been affected by a cybersecurity incident. After a forensic investigation and data review, it says, it determined on June 26, 2026 that files an unauthorized party may have accessed or taken contained personal information, including Social Security numbers, passport numbers, driver’s license numbers and financial account information. Notices to affected individuals began going out on July 13, 2026.
The first proposed class action, No. 2:26-cv-02161, was filed on July 16, 2026 in the U.S. District Court for the District of Nevada. It alleges that Fiesta Insurance did not use reasonable security to protect customer data and waited too long to warn the people involved. On August 12, 2026, the court consolidated five related Fiesta Insurance cases under that first-filed case, where they now proceed together before District Judge Cristina D. Silva. Fiesta Insurance has not admitted wrongdoing, and no court has ruled on whether any of the allegations are true.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Timeline: From Discovery to Consolidation
The dates below come from Fiesta Insurance’s notice, the first complaint and the court docket.- June 9, 2025 — Fiesta Insurance learns that systems in its network were affected by a cybersecurity incident, according to its notice.
- On or around June 19, 2025 — The ransomware group Qilin posts a claim on its dark-web leak site that it hacked Fiesta, according to the complaint, which cites a ransomware-tracking website.
- June 26, 2026 — After its forensic investigation and data review, Fiesta Insurance determines which personal information was in the affected files, its notice says.
- July 13, 2026 — Fiesta Insurance begins notifying the people whose information was in those files.
- July 16, 2026 — The first class action complaint is filed in Nevada federal court.
- August 7, 2026 — Fiesta Insurance files a notice that it does not oppose consolidating the related cases.
- August 12, 2026 — The court consolidates five cases under the lead case, No. 2:26-cv-02161.
- August 18, 2026 — The court sets Fiesta Insurance’s response deadline at 45 days after the plaintiffs file a consolidated complaint.
- September 1, 2026 — The court approves a change to the plaintiffs’ interim leadership group.
What Information Was Involved
Fiesta Insurance’s notice lists the following types of personal information as being in the files that may have been accessed or acquired. The notice says the specific elements vary from person to person.- Full names
- Addresses
- Social Security numbers
- Dates of birth
- Passport numbers
- Financial account information
- Health-related financial information
- Driver’s license numbers
The complaint repeats the same list and refers to the data as personally identifiable information and protected health information. The notice says Fiesta Insurance has no indication that identity theft or fraud has resulted from the incident, and that the people notified were given guidance on protecting their information.
Who Is Affected
Neither Fiesta Insurance’s website notice nor the first complaint gives a total number of people affected. The complaint says the precise number is unclear but that the class can be identified from records in Fiesta Insurance’s possession, and that it includes the company’s consumers. It describes the named plaintiff as a California resident and a current Fiesta Insurance client.The people most directly concerned are those who received a Fiesta Insurance notice letter in or after July 2026. The proposed class described below is broader on its face, covering anyone in the United States whose information was compromised in the incident.
What the Complaint Alleges
The first complaint alleges that cybercriminals were able to get into Fiesta Insurance’s systems because the company did not adequately train its employees on cybersecurity and did not maintain reasonable safeguards. It points to statements in Fiesta’s privacy policy, including that information is kept on servers in a controlled, secure environment, and alleges that the company did not live up to them.The complaint also focuses on timing. It calculates that notices went out 399 days after Fiesta Insurance discovered the incident, and it cites a California statute that requires breach notices within 30 calendar days. It alleges that the delay kept customers from taking timely steps to protect themselves.
Citing a third-party ransomware tracker, the complaint alleges that the Qilin group claimed responsibility for the attack and reportedly leaked 870 GB of data, and it contends on that basis that the stolen information has been or will be published on the dark web. Fiesta Insurance’s notice does not identify an attacker or say whether data was published.
The named plaintiff alleges that unauthorized people applied for lines of credit in her name, producing hard inquiries on her credit report, and that she has received more spam and scam calls about credit lines since the breach. Fiesta Insurance, for its part, says in its notice that it took immediate action on learning of the incident and has added to its existing cybersecurity measures.
The Consolidated Case in Nevada Federal Court
After the notices went out, several proposed class actions over the incident were filed in the U.S. District Court for the District of Nevada. On August 7, 2026, Fiesta Insurance filed a notice that it did not oppose consolidating them. On August 12, 2026, the court granted the motion and consolidated Nos. 2:26-cv-02162, 2:26-cv-02176, 2:26-cv-02209 and 2:26-cv-02218 into the lead case, No. 2:26-cv-02161-CDS-BNW. The consolidated case is assigned to District Judge Cristina D. Silva, with Magistrate Judge Brenda Weksler.An August 18, 2026 order gives Fiesta Insurance 45 days to respond after the plaintiffs file a consolidated complaint. A consolidated complaint usually replaces the individual complaints, so its class definitions, claims and factual allegations may differ from those in the first-filed case described on this page. On September 1, 2026, the court approved a change to the group of plaintiffs’ lawyers serving in an interim leadership role.
Suits over the same incident were also filed in federal court in California, and at least one of them was voluntarily dismissed. Consolidation is a case-management step; it does not decide whether any of the allegations are true.
The Proposed Class
The first complaint proposes a nationwide class of all individuals residing in the United States whose personal or health information was compromised in the June 2025 data breach, including everyone who received notice of it. It also proposes a California subclass made up of California residents whose information was compromised in the breach.Fiesta Insurance, its affiliates, parents and subsidiaries, its officers and directors, and any judge handling the case and that judge’s staff and immediate family are excluded. The complaint reserves the right to amend the class definitions, and the consolidated complaint may define the class differently. No class has been certified.
Claims and Relief Sought
The first complaint asserts ten causes of action:- Negligence
- Breach of implied contract
- Invasion of privacy (intrusion upon seclusion)
- Unjust enrichment
- Violation of California’s Unfair Competition Law (California subclass)
- Violation of the California Consumer Privacy Act (California subclass)
- Violation of the California Customer Records Act (California subclass)
- Violation of California’s Confidentiality of Medical Information Act
- Declaratory judgment
- Violation of the Nevada Consumer Fraud Act
It asks the court to certify the class and to award compensatory, exemplary, punitive and statutory damages as allowed by law, restitution, declaratory relief, attorneys’ fees and costs, and interest. It also seeks an injunction requiring Fiesta Insurance to use adequate data security consistent with industry standards. The complaint says the plaintiff sent Fiesta Insurance a notice letter under the California Consumer Privacy Act and intends to amend the complaint to seek statutory damages under that law if the alleged violations are not cured within 30 days.
What Happens Next
In a consolidated data breach case, the plaintiffs generally file a single consolidated complaint, and the defendant then answers it or asks the court to dismiss some or all of the claims. Cases that survive that stage typically move into discovery and, later, a contested motion for class certification. The parties can also negotiate a settlement at any point, which would need court approval before any payments are made.None of those outcomes is guaranteed, and the timing depends on the court’s schedule. Under the August 18, 2026 order, Fiesta Insurance’s response is due 45 days after the consolidated complaint is filed.
Is There Anything to Claim?
There is no settlement, no claim form and no deadline in the Fiesta Insurance data breach litigation. If the case is resolved through a class settlement, the court would approve a notice explaining who is covered, what the settlement provides and how to take part, and the settlement would be posted on an official settlement website.Questions
Is there a Fiesta Insurance data breach settlement?
There is no settlement. The lawsuits are at the complaint stage in the U.S. District Court for the District of Nevada, no class has been certified, and there is no claim form, fund or deadline.
What information was involved in the Fiesta Insurance data breach?
Fiesta Insurance’s notice says the files that may have been accessed or taken contained full names, addresses, Social Security numbers, dates of birth, passport numbers, financial account information, health-related financial information and driver’s license numbers. The notice says the elements involved vary from person to person.
When did Fiesta Insurance discover the breach and notify people?
According to its notice, Fiesta Insurance learned on June 9, 2025 that systems in its network had been affected by a cybersecurity incident. It says it determined on June 26, 2026 that the files involved held personal information and began notifying affected individuals on July 13, 2026. The first complaint calculates that gap at 399 days.
Why were the Fiesta Insurance lawsuits consolidated?
Several proposed class actions over the same incident were filed in Nevada federal court. On August 12, 2026, the court granted a motion to consolidate five of them under the first-filed case, No. 2:26-cv-02161, after Fiesta Insurance said it did not oppose the request. Consolidation lets related cases move forward together; it does not decide whether any allegation is true.
Who does the complaint say was behind the Fiesta Insurance breach?
The first complaint, citing a ransomware-tracking website, alleges that a ransomware group known as Qilin claimed responsibility on its dark-web leak site on or around June 19, 2025, and that the group reportedly leaked 870 GB of data. Fiesta Insurance’s notice does not name an attacker, and no court has made any finding about who was responsible.
Has Fiesta Insurance admitted wrongdoing?
Fiesta Insurance has not admitted wrongdoing, and no court has ruled on the claims. Its notice says it has no indication that any identity theft or fraud resulted from the incident, that it took immediate action on learning of it, and that it has taken measures to strengthen its existing cybersecurity.
Sources
• Fiesta Insurance data breach litigation, D. Nev. No. 2:26-cv-02161 — CourtListener docket• Class action complaint, ECF No. 1 (filed July 16, 2026) — PDF via CourtListener RECAP
• Fiesta Insurance Franchise Corporation — Notice Regarding Data Security Incident (July 13, 2026)
