Academy Mortgage Data Breach Settlement: $1.995 Million, Claims Not Open Yet
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
This is why the Academy Mortgage lawsuit is back in the news: the Utah lender, whose retail business now belongs to Guild Mortgage, agreed to pay $1,995,000 to settle the class action over its March 2023 ransomware breach. About 285,000 people are covered. As of October 8, 2026, we could not confirm that the judge has approved the deal, and there is no official claim form or deadline yet.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What the Academy Mortgage Class Action Says Happened
Academy Mortgage Corporation was an independent mortgage lender based in Draper, Utah. According to the complaint, Academy discovered on or about March 21, 2023 that it had lost control of its computer network. A ransomware group claimed the attack, and the lawsuit alleges it published stolen data on the dark web around May 14, 2023.
The complaint says personal information of approximately 284,443 current and former customers and employees was involved — names, dates of birth and Social Security numbers. Other descriptions of the case also list financial account details and mortgage application materials.
The lawsuit alleges Academy did not announce the breach until around December 20, 2023, nine months later. It pleads negligence, breach of implied contract, invasion of privacy and state consumer-protection violations. Academy denied wrongdoing in agreeing to settle.
Case Details
The case is Stern v. Academy Mortgage Corporation, No. 2:24-cv-00015-DBB-DAO, in the U.S. District Court for the District of Utah, before Judge David B. Barlow. Suits were filed in January 2024 and consolidated in Utah.
Judge Barlow dismissed the first consolidated complaint without prejudice on January 17, 2025, finding the plaintiffs had not shown a concrete injury. The plaintiffs filed a second amended complaint on May 27, 2025. Academy moved to dismiss again on June 27, 2025. On October 8, 2025 the judge let most claims go forward and dismissed only unjust enrichment.
Separately, California's Department of Financial Protection and Innovation announced on August 13, 2026 a consent order requiring Academy to pay $825,000. That is a regulatory penalty, not money for class members.
Status: Settlement Filed, Approval Not Confirmed
As of October 8, 2026, we could not confirm from a court record whether Judge Barlow has granted preliminary approval. No settlement administrator, official website, claim deadline or final approval hearing date has been published that we could verify.
The next step is a court-approved notice mailed or emailed to class members, with a claim form and the deadlines. Until that notice exists, there is nothing to file. We list the case on our open settlements page and will update this page when the notice is out.
Who Is Covered by the Academy Mortgage Settlement
The class is roughly 285,000 people whose information was exposed in the March 2023 breach. In practice, that means people who received a written data-breach notice from Academy Mortgage Corporation, mostly from December 2023 on.
Who that usually is: people who applied for or took out a home loan with Academy, and current or former Academy employees.
You do not need to sign up anywhere now. If the court approves the deal, the administrator sends notice directly to the people on the class list. Keep your 2023 breach letter — it is the simplest proof you are in the class.
Not to be confused with the West Virginia State Police Academy settlement, an unrelated case that shares only the word “academy.”
What the Academy Mortgage Settlement Would Pay
Documented losses: up to $3,000 for out-of-pocket costs tied to the breach, with proof.
Pro rata cash: an equal share of what is left after other costs. California residents would get a stepped-up share; the amount is not set.
Credit monitoring: three years of one-bureau monitoring with up to $1 million in identity theft insurance.
Class counsel plans to ask for $665,000 in fees, a third of the fund. Six named plaintiffs would get $2,500 each. Before fees, the fund is about $7 per class member; the cash share depends on how many people file. Use our data breach settlement calculator to see how claim rates change that figure.
Separately, the California consent order requires Academy to give affected California borrowers 12 months of free identity-theft insurance. That is not part of the class settlement.
Academy Mortgage Breach and Lawsuit Timeline
- 1
March 21, 2023 — Breach Discovered
Academy finds that intruders have taken control of its network. A ransomware group later claims the attack.
- 2
December 20, 2023 — Notices Go Out
About nine months later, Academy announces the breach and begins notifying about 284,443 people. Class actions follow in January 2024.
- 3
January 17, 2025 — First Complaint Dismissed
Judge Barlow dismisses the consolidated complaint without prejudice for lack of a concrete injury. The plaintiffs refile on May 27, 2025.
- 4
October 8, 2025 — Case Goes Forward
The court keeps negligence, implied contract, privacy and state consumer claims alive and dismisses only unjust enrichment.
- 5
July–August 2026 — Deal Reached and Filed
A settlement notice is filed July 8, 2026. California's regulator announces an $825,000 penalty on August 13, 2026. The $1,995,000 settlement motion follows in late August 2026.
- 6
As of October 8, 2026 — Approval Not Confirmed
No verified preliminary approval, administrator, website or claim deadline. Class notice with a claim form comes after approval.
Three Things to Watch For
The stolen Academy files included loan applications, and the lawsuit alleges they were posted online. That makes fake “settlement” contact very convincing:
“Claim your Academy Mortgage payment” sites
As of October 8, 2026, we could not verify any official settlement website. A page asking for your Social Security number or bank login before a court-approved notice is out is not the claim process.
Calls or emails that quote your old loan
Loan applications and financial documents were in the stolen data, so a scammer may know your loan amount, address or employer. Knowing those details does not make a caller legitimate. No settlement administrator charges a fee to process a claim.
“Guild Mortgage” or “California refund” messages
Guild bought Academy's retail business, and Californians may get a separate notice about identity-theft insurance under the state order. Neither one is a reason to wire money or give a password. Check any letter against the court case number, 2:24-cv-00015.
Academy Mortgage Settlement — Questions People Actually Ask
What is the Academy Mortgage lawsuit about?
It is a data breach class action over the March 2023 ransomware attack on Academy Mortgage Corporation. The plaintiffs allege Academy failed to protect names, birth dates and Social Security numbers of about 284,443 people and waited about nine months to notify them. Academy denies wrongdoing.
Is there an Academy Mortgage settlement I can file a claim in?
A $1,995,000 settlement was filed for approval in late August 2026. As of October 8, 2026, we could not confirm that it has been approved, and there is no verified claim form, website or deadline yet. The claim form comes with the official notice.
How much will I get?
Unknown until claims are counted. The proposed terms offer up to $3,000 for documented losses, or a pro rata cash share, plus three years of credit monitoring. Californians would get a larger cash share. After the $665,000 fee request and other costs, the cash share for people without receipts is likely small.
How do I know if I am in the Academy Mortgage class action?
If you received a data-breach notice from Academy Mortgage Corporation about the 2023 incident, you are likely in the roughly 285,000-person class. Customers and employees were both affected. Keep the letter.
Academy Mortgage is gone — who pays?
Academy sold its retail lending business to Guild Mortgage in late February 2024 and stopped making new loans in March 2024. The settlement is with Academy Mortgage Corporation, the defendant in the case. Guild was not named in the settlement filings.
What was the $825,000 California penalty?
On August 13, 2026, California's Department of Financial Protection and Innovation announced a consent order requiring Academy to pay $825,000 over cybersecurity failures. It covers 34,452 California residents. It also requires 12 months of free identity-theft insurance for affected California borrowers. The penalty goes to the state, not to class members.
Is this the same as the old Academy Mortgage whistleblower case?
No. In December 2022 Academy agreed to pay $38.5 million to settle a False Claims Act case over 1,325 FHA-insured loans, brought by a whistleblower in the Northern District of California. That money went to the government and the whistleblower, not to borrowers, and the claims were allegations only.
What should I do right now?
Keep your breach notice and receipts for any breach-related costs, such as credit freeze fees or fraud losses — they matter for the up-to-$3,000 claim. Freeze your credit at all three bureaus. Watch your mail and email for a court-approved notice that cites case 2:24-cv-00015.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Open Class Action Settlements
Settlements currently taking claims, with deadlines
Data Breach Settlement Calculator
Estimate a payout from fund size, class size and claim rate
Class Action Payout Calculator
How fees, costs and claim rates shrink a per-person share
Freedom Mortgage Lawsuit
Another mortgage lender case: what each suit is about and its status