The $31.5 million Flagstar Bank data breach settlement for about 2.19 million people notified of the 2021 breaches received final approval on October 5, 2026; claims closed August 11, 2026, and payments to approved claimants follow once the settlement becomes effective after the appeal period.
What Is the Flagstar Bank Data Breach Settlement About?
Update, October 20, 2026: Judge Matthew F. Leitman granted final approval of the $31.5 million Flagstar Bank data breach settlement on October 5, 2026, after a final approval hearing on October 1 at which no objectors appeared. He overruled the four written objections, entered judgment and dismissed the case with prejudice. The claim deadline was August 11, 2026. As of September 11, 2026, the administrator had received 257,386 claims, an 11.8% claims rate, including 242,112 claims for the Residual Cash Payment, which class counsel's final approval motion estimated at $55.11, and 43,038 California Statutory Payment claims estimated at $100 each. Payments go out after the settlement becomes effective; no distribution date has been announced.The lawsuit, captioned Angus et al. v. Flagstar Bank, N.A., Case No. 2:21-cv-10657-MFL-DRG, was brought in the United States District Court for the Eastern District of Michigan before Judge Matthew F. Leitman. The court granted preliminary approval of the settlement on March 12, 2026 and final approval on October 5, 2026. The lawsuit alleges that Flagstar failed to adequately protect consumers' personally identifying information (PII) and delayed providing notice of the breaches.
The settlement resolves claims relating to two separate Flagstar data breaches during 2021: a January 2021 breach involving Flagstar's file-sharing platform, and a December 2021 breach. Flagstar denies the claims and is settling without admitting liability. The court has not decided which side is right. The Settlement Administrator is Eisner Advisory Group LLC, operating the official Settlement Website at flagstarsettlement.com.
30-Second Self-Test: Was I in the Flagstar Settlement Class?
If you can answer yes to the question below, you are likely a Settlement Class Member.• Did you receive an Email Notice or Postcard Notice from the Settlement Administrator about the Angus v. Flagstar Bank class action? The notice came from the "Flagstar Settlement Administrator" and contained your Settlement Claim ID. Receiving that notice means Flagstar identified you as one of the approximately 2,186,156 people whose personal information was impacted by either or both of the 2021 breaches.
The claim deadline was August 11, 2026, and has passed; new claims are no longer accepted.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Is Flagstar Bank?
Flagstar Bank, N.A. is a major U.S. national bank. Some background helps clarify the scope of this settlement, because Flagstar has been through significant corporate changes since the 2021 breaches.At the time of the breaches, Flagstar Bank was headquartered in Troy, Michigan and operated as the primary banking subsidiary of Flagstar Bancorp, Inc. In December 2022, New York Community Bancorp (NYCB) acquired Flagstar Bancorp in an all-stock merger. In March 2023, NYCB also acquired certain assets and liabilities of the failed Signature Bridge Bank in an FDIC-assisted transaction. By February 2024, all branches of the combined entity had been rebranded under the Flagstar name. In October 2024, the combined holding company itself was renamed Flagstar Financial, Inc. (NYSE: FLG). On October 17, 2025, the holding company merged into Flagstar Bank, N.A.
The settlement defendant is Flagstar Bank, N.A., the same legal entity that experienced the 2021 breaches. The settlement does not extend to former NYCB legacy customers (who were a different entity at the time) or to former Signature Bank customers. Class membership turns on whether a person’s information was impacted by the 2021 breaches, as shown on Flagstar’s Class List, not on being a customer.
Which Banks Are Included? (A Common Question)
Only one bank is included as a defendant: Flagstar Bank, N.A. The settlement does not cover customers of NYCB legacy operations or of the former Signature Bank, even though all three entities are now combined under the Flagstar name.If you received an Email Notice or Postcard Notice from the Angus v. Flagstar settlement, you are on Flagstar's list as a class member regardless of which current bank name you associate with. If you did not receive a notice, you are most likely not on the list.
How Many People Are Part of the Flagstar Settlement?
The Settlement Class includes approximately 2,186,156 people identified by Flagstar as having personal information impacted by the data breaches (after the administrator removed duplicates from Flagstar’s original estimate of 2,187,170).The class is structured as two overlapping groups:
• Nationwide Settlement Class: approximately 2,186,156 individuals across the United States whose personal information was impacted.
• California Settlement Subclass: approximately 364,000 people who lived in California at the time of the breaches and whose information was impacted. They could claim the same Nationwide Class benefits plus an additional California Statutory Payment of up to $100 under the California Consumer Privacy Act (CCPA).
What Are the Four Flagstar Settlement Benefits?
The $31.5 million Settlement Fund supports four separate benefit tiers. Class members may be eligible for one, several, or all of them depending on what documentation they have and where they reside.Benefit 1: Documented Monetary Losses Reimbursement (up to $25,000). Class members can be reimbursed for out-of-pocket losses fairly traceable to the data breaches, up to a maximum of $25,000 per claimant. Qualifying losses can include unreimbursed fraud or identity-theft losses; professional fees such as attorneys’, accountants’ and credit-repair fees; credit freeze or unfreeze costs; credit monitoring costs incurred because of the breaches through the date of the claim; and expenses such as notary, fax, postage, copying, mileage and long-distance phone charges. Losses before January 20, 2021 are not covered, and the settlement does not pay for lost time. Documentation not prepared by the claimant was required.
Benefit 2: Residual Cash Payment (estimated at $55.11). Class members could claim a cash payment regardless of whether they had documented losses. The notice estimated about $60; class counsel's September 17, 2026 final approval motion put the estimate at $55.11, based on 242,112 cash claims received as of September 11, 2026. The final amount depends on what remains of the fund after the other benefits, fees and costs. No proof beyond the Claim ID was required for this tier.
Benefit 3: Three Years of Three-Bureau Credit Monitoring. All Settlement Class Members are eligible for three years of credit monitoring services covering all three major bureaus (Equifax, Experian, and TransUnion). No proof beyond the Claim ID is required.
Benefit 4: California Statutory Payment (up to $100). California Settlement Subclass members (approximately 364,000 people who lived in California at the time of the breaches) could claim an additional payment of up to $100 under the California Consumer Privacy Act (CCPA). This stacks on top of the Nationwide Class benefits. No proof beyond the Claim ID and California residency is required.
Documented-loss and California payments would be reduced pro rata only if together they exceeded what remains after fees, costs and credit monitoring, in which case there would be no Residual Cash Payment. As of September 11, 2026, documented-loss claims totaled $53,919.32 across 99 claims.
Do I Need Proof to File a Flagstar Claim?
Yes, but with important nuances by benefit tier. The proof structure works in two layers:Layer 1: Your Settlement Claim ID is required to file at all. The Settlement Administrator mailed or emailed a Notice to every identified class member. The Email Notice has your Claim ID printed above your name at the top. The Postcard Notice has it above your name and address. Without that Claim ID, you cannot access the online claim portal. The Claim ID itself is the proof you are on Flagstar's list of identified class members; you do not need to produce any account statements or breach notification letters to start.
Layer 2: Receipts are only required for the $25,000 Documented Monetary Losses tier. If you want to claim reimbursement for out-of-pocket losses, you must upload supporting documentation through the claim portal: bank statements, identity theft reports, fraud-resolution invoices, credit-freeze or credit-monitoring receipts, and similar records not prepared by the claimant. The settlement does not pay for lost time. The other three benefit tiers (Residual Cash, Credit Monitoring, California Statutory) require only the Claim ID and basic identifying information.
If you lost your Notice or did not receive one but believe you are eligible, contact the Settlement Administrator through the official Settlement Website.
What Were the 2021 Flagstar Data Breaches?
Two separate breaches at Flagstar occurred during 2021. Both involved the unauthorized access and exfiltration of personal information.January 2021 breach. Flagstar publicly announced on March 5, 2021 that it had been the victim of a cyberattack in January 2021. Cyber criminals infiltrated a file-sharing platform used by Flagstar and accessed the personally identifiable information of approximately 1.47 million individuals in the United States. The platform involved was the Accellion File Transfer Appliance (FTA), a legacy file transfer product. The Accellion FTA breach in early 2021 was one of the highest-profile supply-chain cyber incidents of that year, affecting dozens of organizations worldwide that used the same product. The Angus lawsuit alleges that Flagstar did not adequately protect consumers’ personal information and delayed in providing notice of the breaches.
December 2021 breach. Flagstar announced on June 17, 2022 that hackers had infiltrated its network in December 2021 and accessed the personally identifiable information of approximately 1.58 million people. After removing duplicates across both breaches, the class totals approximately 2,186,156 people, including approximately 364,000 who lived in California.
Flagstar denies wrongdoing and any allegation that its data security practices were inadequate. The settlement resolves both breach groups together without an admission of liability by Flagstar.
How Were Flagstar Claims Filed?
Claims could be filed online at the official Settlement Website, flagstarsettlement.com, using the Settlement Claim ID from the notice, or on a printed claim form mailed to the Settlement Administrator and postmarked by August 11, 2026. Documented-loss claims required supporting records. The claim period has closed.Key Flagstar Settlement Deadlines
• Claim deadline (passed): Tuesday, August 11, 2026 (online, or postmarked by mail)
• Opt-out deadline (passed): Monday, June 29, 2026
• Objection deadline (passed): Monday, June 29, 2026
• Final Approval Hearing: held Thursday, October 1, 2026 by Zoom before Judge Matthew F. Leitman, United States District Court for the Eastern District of Michigan
• Final Approval Order and Judgment: signed October 5, 2026
• Class period covered: individuals impacted by the January 2021 and December 2021 Flagstar data breaches
When Will I Receive My Flagstar Settlement Payment?
The court granted final approval on October 5, 2026. Payment timing now depends on when the settlement becomes effective.• Final approval: granted October 5, 2026, with judgment entered and the case dismissed with prejudice.
• Effective Date: under the settlement agreement, the first business day after the judgment becomes final, meaning the time to appeal has run out with no appeal, or any appeal has been resolved. Federal appeals generally must be filed within 30 days of judgment.
• Payment distribution: the agreement says payments are made as soon as practicable after the Effective Date and not before it. No distribution date had been announced on the Settlement Website as of October 20, 2026.
• Checks: paper checks expire 90 days after they are issued.
Any money left after payments and uncashed checks goes first to extending credit monitoring and then to a court-approved cy pres recipient, according to the final approval order.
What Happens If I Do Nothing?
If you do nothing, you remain in the Settlement Class (unless you opt out) and will be bound by the Court's decisions, but you will not receive any settlement benefits. You will also give up the right to sue, continue to sue, or be part of another lawsuit against Flagstar related to the legal claims this settlement resolves.Because the claim deadline has passed, class members who did not file a claim will not receive settlement benefits but are still bound by the release.
How Could Class Members Opt Out or Object?
Class members who did not want to be bound by the settlement had two alternatives, both with the same June 29, 2026 deadline.Opting out means receiving no settlement benefits, but preserving the right to file your own lawsuit against Flagstar over the data breach claims. Opt-out requests must be in writing and submitted to the Settlement Administrator following the instructions on the official Settlement Website. This is the only option that keeps your right to sue.
Objecting means staying in the class (and remaining eligible for benefits) but asking the Court to reject or modify the settlement. Written objections must be electronically filed with the Court or mailed to the Clerk of Court at the United States District Court for the Eastern District of Michigan, with the objection postmarked by June 29, 2026. Objections must include the case name and number, contact information, a statement of whether the objection applies to you or the broader class, the specific grounds for the objection, and a statement of whether you intend to appear at the Final Approval Hearing.
Other Active Data Breach Class Action Settlements
Data breach class action settlements covering banks, retailers, healthcare providers, and tech companies are common. Class members in one data breach may qualify for unrelated breach settlements covering different companies; filing in one does not affect eligibility for any others. Many recent data breach settlements offer similar four-tier structures: small flat cash, documented losses reimbursement, credit monitoring, and California-specific CCPA payments stacked on top.Check the OCA database of open class action settlements for other active data breach and consumer privacy cases.
Flagstar Settlement Questions
Who qualifies for the Flagstar Bank data breach settlement?
The class is the approximately 2,186,156 people Flagstar identified as having personal information impacted by the January 2021 or December 2021 data breaches. It includes a Nationwide Class and a California Subclass of approximately 364,000 people who lived in California at the time of the breaches, who could claim an additional California Statutory Payment. Class membership is established by Flagstar's own records. The Settlement Administrator mailed or emailed notices with Settlement Claim IDs to all identified class members. Excluded from the class are Flagstar, its officers and affiliates, the judge and immediate family, and anyone who timely opts out.
How much can I get from the Flagstar settlement?
Claimants could choose among four benefits: (1) reimbursement for documented out-of-pocket losses related to the data breaches, up to $25,000 per claimant (proof required); (2) a Residual Cash Payment, which class counsel's September 2026 final approval motion estimated at $55.11 based on the 242,112 cash claims filed as of September 11, 2026; (3) three years of three-bureau credit monitoring services; and (4) for California residents, a California Statutory Payment estimated at $100. The claim deadline was August 11, 2026.
What is Flagstar Bank?
Flagstar Bank, N.A. is a major U.S. national bank. At the time of the 2021 data breaches, Flagstar Bank was headquartered in Troy, Michigan and operated as a subsidiary of Flagstar Bancorp, Inc. In December 2022, New York Community Bancorp (NYCB) acquired Flagstar Bancorp. In October 2024, the combined holding company renamed itself Flagstar Financial, Inc. (NYSE: FLG), and on October 17, 2025 it merged into Flagstar Bank, N.A., which is now the publicly traded company. The settlement defendant is the same legal entity, Flagstar Bank, N.A., that experienced the 2021 breaches. The class includes only people whose personal information was impacted by one or both 2021 breaches, as shown on Flagstar’s Class List.
Do I need proof to file a Flagstar settlement claim?
Yes. Claimants needed the Settlement Claim ID from the notice the Settlement Administrator mailed or emailed, which showed they were on Flagstar's list of class members. The Residual Cash Payment, California Statutory Payment and credit monitoring required no other documents; the documented-loss tier of up to $25,000 required supporting records such as bank statements, identity theft reports or receipts. The claim deadline passed on August 11, 2026.
What is the deadline to file a Flagstar settlement claim?
The claim deadline was August 11, 2026 for online submissions, or postmarked by August 11, 2026 for mailed claim forms. The opt-out deadline is earlier, on June 29, 2026, and the objection deadline is also June 29, 2026. Those deadlines have passed. Judge Matthew F. Leitman of the U.S. District Court for the Eastern District of Michigan held the final approval hearing on October 1, 2026 and granted final approval on October 5, 2026.
What was the Flagstar Bank data breach about?
Flagstar Bank experienced two separate data breaches in 2021. The first, in January 2021, involved a cyberattack on a file-sharing platform Flagstar used, in which cyber criminals accessed the personally identifiable information (PII) of approximately 1.47 million people. The January 2021 breach was part of the larger Accellion FTA (File Transfer Appliance) supply-chain breach that affected many organizations worldwide that year. The second Flagstar breach occurred in December 2021; Flagstar announced on June 17, 2022 that hackers had accessed the PII of approximately 1.58 million people. The lawsuit alleges that Flagstar did not adequately protect consumer and employee personal information and delayed providing breach notices. Flagstar denies these claims, and the court has not decided who is right. The settlement resolves the dispute without an admission of liability.
When will I receive my Flagstar settlement payment?
The court granted final approval on October 5, 2026. Under the settlement agreement, payments go out as soon as practicable after the Effective Date, which is the first business day after the judgment becomes final — after the time to appeal runs out with no appeal, or after any appeal is resolved. No distribution date had been announced as of October 20, 2026. Paper checks expire 90 days after they are issued.
Official Settlement Notice
Sources
• Official Settlement Website: FlagstarSettlement.com• Angus et al. v. Flagstar Bank, N.A., Case No. 2:21-cv-10657-MFL-DRG, U.S. District Court for the Eastern District of Michigan, Hon. Matthew F. Leitman presiding
• Notice of Proposed Class Action Settlement
• Order Granting Preliminary Approval (March 12, 2026)
• Plaintiffs' Motion for Final Approval (ECF No. 134, September 17, 2026), with claims figures as of September 11, 2026
• Final Approval Order and Judgment (ECF No. 137, October 5, 2026): fees of $10,500,000, costs of $311,690.80, $2,500 service awards, 48 opt-outs, four objections overruled
• Settlement Administrator: Eisner Advisory Group LLC
