Published
October 14, 2026
Union Home Mortgage customers, loan applicants and employees whose information was involved in the 2025 ransomware attack on Union Home Mortgage Corp. may be covered by a proposed class action alleging Union Home failed to protect their names, Social Security numbers and other personal information. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes a class action lawsuit and a court ruling at the pleading stage. The plaintiffs’ statements are unproven allegations. Union Home Mortgage Corp. denies wrongdoing and has not been found liable, there is no certified class, and there is nothing to claim at this time. This page is informational and is not legal advice.
What Happened at Union Home Mortgage?
Union Home Mortgage Corp. is a privately held mortgage lender founded in 1970 and based in Strongsville, Ohio, that operates in 48 states and the District of Columbia. According to the court’s September 28, 2026 opinion, Union Home learned on June 25, 2025 that a third party had gained access to its network. On August 26, 2025, after an investigation, it determined that as early as May 27, 2025 a ransomware group known as Qilin had gained access to personal information of its customers and employees.Union Home admits in its answer to the lawsuit that it issued a public disclosure and began sending notice letters on or about August 29, 2025. The version of the letter filed with the Montana Department of Justice, dated September 11, 2025, tells recipients that Union Home had their information because they applied, or co-applied, for a loan or related service, and that the information involved varied by person but may have included a name, loan number, Social Security number, driver’s license or government-issued ID number, or date of birth. The letter says Union Home had “no evidence of the misuse, or attempted misuse” of the information and offers 12 months of free credit monitoring and identity protection.
The breach led to a consolidated proposed class action, In re Union Home Mortgage Corp. Data Breach Litigation, No. 1:25-cv-01874, in the U.S. District Court for the Northern District of Ohio, assigned to Judge Solomon Oliver, Jr. The first complaint was filed September 8, 2025, and fourteen named plaintiffs filed a consolidated complaint on November 3, 2025. On September 28, 2026, the judge denied most of Union Home’s motion to dismiss, and on October 13, 2026, Union Home filed its answer denying the allegations.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Status
Most Claims Survive Motion to Dismiss
Ruling September 28, 2026 · answer filed October 13, 2026 · no class certified
People Affected
425,538
total in Union Home’s report to the Texas Attorney General, including 24,160 Texans
Data Involved
Names, Social Security numbers, dates of birth, loan numbers and ID numbers
driver’s license, passport or other government ID, per Union Home’s notice letter and state filings
Next Court Date
November 5, 2026
telephonic status conference on a case management schedule
Can I Claim?
No — nothing to claim yet
How the Attack Happened, According to Union Home
Union Home’s account comes from a sworn declaration by its chief information officer, filed with its motion to dismiss in December 2025. He states that on May 27, 2025, a Union Home employee visited a legitimate third-party business website on which Qilin had planted malicious software, which led to malware being installed on the employee’s computer. The group then compromised other employees’ accounts, deployed ransomware that encrypted parts of the network, and took data that included personal information of some Union Home customers, employees and others, according to the declaration.The declaration says Qilin threatened to release the data unless it was paid, and that Union Home paid the ransom on the condition that the group delete the stolen data and not target the company again. Qilin then confirmed the deletion and provided logs showing it, Union Home says. The filings reviewed for this page do not state the amount paid. Union Home says it has since added web filtering, stronger endpoint detection and other tools to detect account takeovers and data theft.
An expert retained by Union Home reported finding no sign that the data had been posted on Qilin’s website or other places where such data is commonly posted, including in a second search in July and August 2026. The same expert acknowledged that “there is no way to verify that Qilin deleted all copies of the data.” These are Union Home’s statements and its expert’s opinions; the court has not adopted them as findings.
What the Lawsuit Alleges
The consolidated complaint alleges that Union Home failed to adequately protect the personal information it collected from borrowers, loan applicants and employees, including by not encrypting it, and that it took about two months after detecting the intrusion to notify the people involved. The plaintiffs also allege, on information and belief, that email addresses and phone numbers were exposed because that information is commonly stored alongside the other data.As summarized in the court’s opinion, all of the named plaintiffs say they have received more spam calls and text messages since the breach. Nine say they were alerted that their information was posted on the dark web. Others describe attempted unauthorized withdrawals from bank accounts, fraudulent card charges, a drop in a credit score, and bills for medical appointments one plaintiff says she never attended. The complaint seeks damages and court-ordered relief, including lifetime credit monitoring and identity theft protection.
Union Home denies every allegation of wrongdoing or liability and says it acted reasonably and lawfully at all times. None of the plaintiffs’ allegations has been proven.
Who Is in the Proposed Class?
The complaint proposes a nationwide class of everyone in the United States whose personal information was compromised in the breach Union Home announced in August 2025, including everyone who received a notice. It also proposes a California subclass and a North Carolina subclass of residents of those states. Union Home’s officers, directors and affiliates, and the assigned judge, are excluded. The definitions are proposals; a court would have to certify a class before anyone is formally part of the case.How Many People Were Affected?
Union Home’s breach report on the Texas Attorney General’s data breach portal lists 425,538 individuals affected in total, including 24,160 Texans. It gives a breach window of May 27 to June 29, 2025 and lists names, addresses, Social Security numbers, driver’s license numbers, government-issued ID numbers such as passports or state ID cards, and dates of birth among the information involved.Washington’s Attorney General lists 1,650 Washington residents, from a notice Union Home submitted on September 11, 2025 that describes the incident as a ransomware cyberattack. Union Home admits in its answer that it reported the breach to the Washington and Texas attorneys general in September 2025, but the court filings reviewed for this page do not state a nationwide total.
What the Judge Ruled on September 28, 2026
Union Home asked the court to dismiss the whole case. It argued that the plaintiffs lacked standing to sue, in part because paying the ransom meant the data went only to Qilin and was then deleted, and because much of the plaintiffs’ information was already on the dark web from earlier breaches at other companies. Judge Oliver rejected those arguments at this stage. He found that the increase in spam calls and texts each plaintiff described counts as a concrete injury under Sixth Circuit precedent, and that the plaintiffs plausibly alleged their information spread beyond Qilin. He also wrote that a new posting of someone’s data is a fresh privacy harm even if the same data was exposed before.The judge found that Union Home’s declarations and expert reports did not rule out that the plaintiffs’ information was leaked, noting that the expert himself called the deletion unverifiable. He did find the risk of a second breach at Union Home “not particularly high,” so the plaintiffs lack standing to seek orders aimed at preventing future breaches. They may still seek relief addressing harm from the breach that already happened.
On each claim, the court ruled:
- Negligence: survives. The court found Union Home owed a duty under Ohio law to safeguard the information and that a breach of that duty was plausibly alleged.
- Breach of implied contract: survives.
- Unjust enrichment: dismissed, because the plaintiffs did not plausibly allege that handing over their information conferred a separate benefit on Union Home.
- California Consumer Privacy Act (California subclass): survives, except that the opinion bars statutory damages. The plaintiffs’ pre-suit notice letters were mailed October 21, 2025, and the consolidated complaint was filed November 3, 2025, short of the 30 days the statute requires before suing for statutory damages.
- Declaratory judgment and injunctive relief: dismissed, except the request for an order requiring credit monitoring, identity theft insurance and identity theft protection services.
- North Carolina Unfair and Deceptive Trade Practices Act (North Carolina subclass): survives. The court found it plausible, at this stage, that Union Home concealed weaknesses in its security measures, as the plaintiffs allege.
The court also granted Union Home permission to file its expert’s supplemental report, which it considered only on the factual standing challenge. Rulings on a motion to dismiss decide whether the allegations, taken as true, state a legal claim. They are not findings that Union Home did anything wrong.
Union Home’s Answer
Union Home filed its answer to the consolidated complaint on October 13, 2026. It admits the basic timeline, including that it learned of the unauthorized access on or about June 25, 2025 and began sending notices on or about August 29, 2025, and denies the plaintiffs’ allegations of wrongdoing. It lists 17 affirmative defenses, among them lack of standing, that criminal acts of third parties caused any harm, that the information at issue is exempt from the California Consumer Privacy Act under the federal Gramm-Leach-Bliley Act, and that some class members’ claims are subject to arbitration agreements and class action waivers.What Happens Next
The court set a telephonic status conference for November 5, 2026 to discuss next steps, including a case management schedule, and directed the lawyers to confer beforehand. The case now moves toward discovery. Whether the case proceeds as a class action depends on a later class certification ruling, and the arbitration defense Union Home raised could affect some people’s claims. There is no settlement and nothing to file. If the case settles, people in the settlement class would normally receive a notice explaining how to file a claim.Other mortgage lenders have faced similar suits. NFM Lending was sued after a ransomware group claimed to have taken borrowers’ data, and settlements over earlier breaches at McLean Mortgage and Mortgage Investors Group are taking claims. Open data breach settlements are collected on the data breach settlements hub.
Questions
Is there a Union Home Mortgage data breach class action?
A consolidated proposed class action, In re Union Home Mortgage Corp. Data Breach Litigation, No. 1:25-cv-01874, is pending in the U.S. District Court for the Northern District of Ohio before Judge Solomon Oliver, Jr. The first complaint was filed September 8, 2025, and a consolidated complaint followed on November 3, 2025. On September 28, 2026 the judge let most of the claims proceed. No class has been certified, there is no settlement, and there is nothing to claim.
How many people were affected by the Union Home Mortgage data breach?
Union Home Mortgage’s breach report on the Texas Attorney General’s data breach portal lists 425,538 individuals affected in total, including 24,160 Texans. Washington’s Attorney General lists 1,650 Washington residents. Union Home has not stated a nationwide total in the court filings reviewed for this page.
Did Union Home Mortgage pay a ransom?
Union Home says in court filings that it paid a ransom to the ransomware group Qilin on the condition that the group delete the stolen data and not target the company again, and that the group later provided logs showing the data had been deleted. The filings reviewed for this page do not state how much was paid. Union Home’s own expert wrote that there is no way to verify that every copy was deleted, and the judge ruled that the payment did not defeat the plaintiffs’ standing to sue at the pleading stage.
What did the judge decide in the Union Home Mortgage lawsuit?
On September 28, 2026 the court granted Union Home’s motion to dismiss in part and denied it in part. Negligence, breach of implied contract, the North Carolina Unfair and Deceptive Trade Practices Act claim and most of the California Consumer Privacy Act claim survived. The unjust enrichment claim was dismissed, and the declaratory judgment and injunctive relief claim was dismissed except for the request for credit monitoring, identity theft insurance and identity theft protection services. The opinion also says the California claim cannot seek statutory damages. These are pleading-stage rulings, not findings that Union Home did anything wrong.
Is there anything to claim from the Union Home Mortgage lawsuit?
There is nothing to claim at this stage. The case has not settled and no class has been certified. If the case settles, people in the settlement class would normally receive a notice explaining how to file a claim.
Sources
• Opinion and Order, In re Union Home Mortgage Corp. Data Breach Litigation, No. 1:25-cv-01874 (N.D. Ohio, September 28, 2026), ECF No. 29: GovInfo and opinion (PDF).• Consolidated Class Action Complaint, ECF No. 12 (filed November 3, 2025): consolidated complaint (PDF).
• Declaration of Union Home’s Chief Information Officer in support of the motion to dismiss, ECF No. 15-2 (filed December 18, 2025): declaration (PDF).
• Union Home Mortgage Corp.’s Answer to Consolidated Class Action Complaint, ECF No. 30 (filed October 13, 2026): answer (PDF).
• Docket: In re Union Home Mortgage Corp. Data Breach Litigation (CourtListener).
• Texas Attorney General: Data Security Breach Reports (Union Home Mortgage Corp. entry).
• Washington State Attorney General: Data Breach Notifications (Union Home Mortgage Corp, submitted September 11, 2025).
• Montana Department of Justice, Office of Consumer Protection: Union Home Mortgage Corp. notice of data security incident (PDF), dated September 11, 2025.
For more class actions keep scrolling below.
Status
Motion to Dismiss Granted in Part, Denied in Part — No Class Certified
Case Title
In re Union Home Mortgage Corp. Data Breach Litigation
Case Number
1:25-cv-01874
Court
U.S. District Court, Northern District of Ohio (Eastern Division)
Judge
Solomon Oliver, Jr.
Date Filed
September 8, 2025 (consolidated complaint November 3, 2025)
