Current and former Mr. Cooper mortgage customers whose personal information was taken in the October 2023 cyberattack may be covered by a proposed class action alleging Mr. Cooper failed to protect their names, Social Security numbers and bank account numbers. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes a class action lawsuit. The statements below are unproven allegations. Mr. Cooper has not been found liable, there is no certified class, and nothing to claim at this time. This page is informational and is not legal advice.
What Is This About?
Customers of Mr. Cooper, one of the largest mortgage servicers in the U.S., sued after an October 31, 2023 cyberattack in which personal information on about 14.7 million current and former customers was taken. The lawsuits were consolidated as Cabezas v. Mr. Cooper Group Inc., No. 3:23-cv-02453-N, in the U.S. District Court for the Northern District of Texas before Senior U.S. District Judge David C. Godbey. The defendants are Mr. Cooper Group Inc. and Nationstar Mortgage LLC, which does business as Mr. Cooper.The case is in the class certification stage. On October 19, 2026, the court granted a joint request to change the class certification schedule, moving the date the briefs are submitted from November 23, 2026 to February 12, 2027 and adding deadlines for motions challenging expert witnesses. There is no settlement and no claim form.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Happened in the Breach?
According to the consolidated complaint, Mr. Cooper was hit by a cyberattack on October 31, 2023 and disclosed it the following month. On December 15, 2023, the company told regulators its forensic review found that personal information relating to substantially all current and former customers had been obtained, and its notice to the Maine Attorney General put the number at 14,690,284. The data included names, addresses, phone numbers, Social Security numbers, dates of birth and bank account numbers.The court’s July 2025 opinion describes the attack as ransomware: the hackers took control of Mr. Cooper’s network and customer data, Mr. Cooper paid the ransom, and the hackers returned control of the systems and gave assurances the data had been deleted. The plaintiffs allege the hackers kept a separate copy and that the data is now on the dark web. Those allegations have not been proven.
What Has the Court Decided So Far?
Mr. Cooper moved to dismiss the consolidated complaint. In a July 22, 2025 opinion, the court found the plaintiffs had standing to pursue their claims for damages, but not their claims for declaratory and injunctive relief, which it called too speculative. It allowed the negligence and breach of implied contract claims to go forward.The court dismissed the claims for breach of express contract, unjust enrichment, invasion of privacy and breach of confidence, finding among other things that Mr. Cooper’s general privacy policy was a statement of corporate policy rather than an enforceable contract. It deferred ruling on the negligence per se claim and the individual state-law claims until class certification. Mr. Cooper then answered the consolidated complaint. No court has found Mr. Cooper liable.
Who Would Be Covered?
The consolidated complaint proposes a nationwide class of all individuals living in the U.S. whose personal information was accessed or acquired in the data breach Mr. Cooper announced in or around November 2023. It also proposes subclasses for residents of Alabama, California, Florida, Illinois, Missouri, Montana, Nevada, New York and North Carolina, whose state consumer protection and data breach laws are the basis of some claims.These classes are proposed only. Whether the case proceeds as a class action, and for which groups, is what the court will decide on the class certification motion.
What Happens Next?
Under the schedule set June 26, 2026 and modified October 19, 2026, the plaintiffs’ class certification motion, Mr. Cooper’s opposition and the plaintiffs’ reply are exchanged between the parties, and the full set of briefs is submitted to the court on February 12, 2027. Opening motions challenging expert witnesses are due November 23, 2026, oppositions January 18, 2027 and replies February 1, 2027. The court will rule on class certification after that, and no trial date or settlement has been announced. OpenClassActions.com will update this page as the case develops.Questions
Is there a Mr. Cooper data breach settlement?
No. As of October 19, 2026, the consolidated case in the Northern District of Texas had not settled, no class had been certified, and there was no claim form or settlement website. Any site claiming to take Mr. Cooper data breach settlement claims would not be an official one.
Which claims against Mr. Cooper are still in the case?
In July 2025 the court allowed claims for negligence and breach of implied contract to proceed and dismissed claims for breach of express contract, unjust enrichment, invasion of privacy and breach of confidence. It put off ruling on negligence per se and the state-law claims until class certification, and found the plaintiffs lacked standing to seek declaratory and injunctive relief.
What does the October 19, 2026 order change?
It moves the date the class certification briefs are submitted to the court from November 23, 2026 to February 12, 2027, and adds a schedule for motions challenging the parties’ expert witnesses: opening motions November 23, 2026, oppositions January 18, 2027 and replies February 1, 2027. Both sides asked for the change.
Does a person need to join the Mr. Cooper lawsuit to be included?
No sign-up exists. The case is a proposed class action, so if a class is certified or the case settles, the court-approved notice process would tell class members what, if anything, they can do. Nothing can be claimed at this stage.
Sources
- Court docket, Cabezas v. Mr. Cooper Group Inc., No. 3:23-cv-02453-N (N.D. Tex.) — CourtListener
- Order Granting Joint Motion to Modify Class Certification Scheduling Order (ECF No. 212), October 19, 2026
- Order Granting Unopposed Motion to Modify Class Certification Scheduling Order (ECF No. 199), June 26, 2026
- Memorandum Opinion and Order on the motion to dismiss (ECF No. 124), July 22, 2025
- Consolidated Class Action Complaint (ECF No. 70), July 15, 2024
