Flagstar Data Breach Settlement: Final Approval on October 5, 2026
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
The Flagstar class action lawsuit over two 2021 data breaches is settled. Judge Matthew F. Leitman granted final approval of the $31.5 million settlement on October 5, 2026. The claim deadline was August 11, 2026 and has passed, so no new claims can be filed. If you filed one, there is nothing more to do right now: payments come only after any appeals are resolved.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What the Flagstar Lawsuit Was About
Flagstar Bank, a Michigan mortgage lender and bank, was hit by two separate cyberattacks in the same year. According to the settlement notice, in January 2021 criminals got into a file sharing platform Flagstar used and accessed personal information of about 1.47 million people; Flagstar announced it on March 5, 2021. Bloomberg Law reports that platform was Accellion's file-transfer software.
In December 2021 a second attack reached Flagstar's own network and exposed about 1.58 million people; Flagstar announced that one on June 17, 2022. Many people were in both. The lawsuit alleges Flagstar did not adequately protect the data and delayed telling customers. Flagstar denies the claims, and no court found it liable.
Case Details
The case is Angus, et al. v. Flagstar Bank, N.A., No. 2:21-cv-10657-MFL-DRG, in the U.S. District Court for the Eastern District of Michigan, before Judge Matthew F. Leitman. It was filed in 2021 and settled after mediation before a retired federal judge. The settlement agreement is dated October 1, 2025; the court granted preliminary approval by order of March 12, 2026 (ECF No. 124) and final approval on October 5, 2026 (ECF No. 137). The official site is flagstarsettlement.com, where the final approval order is posted.
Status: Approved, Claims Closed, Payments Pending
Our earlier report on the claim window is here. That window closed on August 11, 2026. The settlement FAQ says money is distributed after final approval and after any appeals are resolved, and warns that appeals can take more than a year.
Who Is in the Settlement Class
The final order certifies a class of everyone in the United States whose personal information was impacted by either or both of the two 2021 Flagstar data breaches, as shown on Flagstar's class list. That is approximately 2,186,156 people per the final order (the notice said 2,187,170), including approximately 364,000 California residents.
Being a class member is not the same as getting paid. Only people who filed a valid claim form by August 11, 2026 receive money or credit monitoring. If you did nothing, you are bound by the settlement and gave up the right to sue Flagstar over these breaches, but you receive no benefit.
How Much the Flagstar Settlement Pays
— Documented losses: up to $25,000 with receipts for fraud, credit freezes, professional fees and similar costs.
— Residual cash payment: estimated at $60, capped at $599, set pro rata from what is left after fees, costs, credit monitoring and loss claims.
— California payment: up to $100 for people who lived in California at the time.
— Credit monitoring: three years of three-bureau monitoring through IDX.
The $60 figure was class counsel's estimate, not a guarantee. If claims exceed the money available, loss and California payments are reduced proportionally and there is no residual payment. You can estimate comparable claims with our data breach settlement calculator.
How cases like this one end
Our copy of the federal courts’ own case database covers 111,990 other personal injury casesclosed in U.S. federal district courts between 2015 and 2025, 3.6% of them filed as class actions:
- 39.9% ended in a settlement recorded by the court. Another 13.8% were dismissed voluntarily, which often follows a private settlement — so the real settlement share sits between 39.9% and 53.7%.
- 5.7% were decided on a motion before any trial.
- 1 in 106 reached a trial (0.9%), after a median of 23.9 months.
- Median time from filing to the end of the case: 9 months.
- Only 771 of them (0.7%) record a money award at all; the median of those is $500,000.
These are base rates for this type of case (federal other personal injury cases) — not a prediction about this lawsuit, and not legal advice. Source: Federal Judicial Center, Integrated Database (civil), analysed by Settlement Insight. Cases heard in state courts are not included.
Flagstar Data Breach Timeline
- 1
January 2021 — First Breach
Attackers access a file sharing platform used by Flagstar, exposing data of about 1.47 million people. Flagstar announces it on March 5, 2021.
- 2
December 2021 — Second Breach
A separate attack reaches Flagstar's network and exposes about 1.58 million people. Flagstar announces it on June 17, 2022.
- 3
October 1, 2025 — Settlement Signed
After mediation, the parties sign a $31.5 million settlement in Angus v. Flagstar Bank, No. 2:21-cv-10657.
- 4
March 12, 2026 — Preliminary Approval
Judge Leitman preliminarily approves the deal. Notice goes out by mail and email starting in May 2026.
- 5
June 29 and August 11, 2026 — Deadlines Pass
The opt-out and objection deadline was June 29, 2026; the claim deadline was August 11, 2026. Both are closed.
- 6
October 5, 2026 — Final Approval
After an October 1, 2026 hearing, the court grants final approval and the fee award. Payments follow once any appeals are resolved.
Three Things to Watch For
A finally approved settlement with a closed claim window attracts people who pretend otherwise:
“Late claims still accepted” offers
The Flagstar claim deadline was August 11, 2026. Anyone offering to file a Flagstar claim now, for a fee or in exchange for your Social Security number, is not working for the court.
“Pay a fee to release your payment”
Fees and costs are deducted from the fund by court order. The administrator does not ask claimants to pay anything to receive their money. Verify by calling the number listed on flagstarsettlement.com, 1-855-542-0397.
Fake IDX or credit-monitoring enrollment links
Claimants who chose credit monitoring get IDX enrollment instructions by email after approval. Before entering personal data, confirm the code and link match what the official settlement site describes.
Flagstar Data Breach Settlement — Questions People Actually Ask
Is the Flagstar data breach settlement approved?
Yes. Judge Matthew F. Leitman granted final approval on October 5, 2026 in Angus v. Flagstar Bank, N.A., No. 2:21-cv-10657 (E.D. Mich.), after a hearing on October 1, 2026.
Can I still file a Flagstar claim?
No. The deadline to submit a claim form was August 11, 2026 (online, or postmarked by that date). The official site lists it as passed.
When will Flagstar settlement payments be sent?
No date has been announced as of October 8, 2026. The settlement FAQ says payments go out after final approval and after any appeals are resolved, which can take more than a year. Watch flagstarsettlement.com for updates.
How much will I get?
It depends on what you claimed: documented losses up to $25,000, a residual cash payment estimated at $60 (maximum $599), up to $100 for California residents, and/or three years of credit monitoring. Residual amounts are pro rata and not final until claims are processed.
Which Flagstar data breach does this settlement cover?
Only the two 2021 breaches: the January 2021 attack on a file sharing platform and the December 2021 attack on Flagstar's network. It does not cover the separate 2023 MOVEit incident at vendor Fiserv, in which Flagstar notified 837,390 customers; we found no Flagstar settlement for that incident.
Is there another Flagstar lawsuit?
Yes, but not for customers. Shareholders sued over disclosures by Flagstar's parent, then New York Community Bancorp, about its loans and acquisitions. The consolidated case is In re: New York Community Bancorp, Inc. Securities Litigation, No. 1:24-cv-00903 (E.D.N.Y.). Per Flagstar's 10-Q for the quarter ended June 30, 2026, a motion to dismiss filed August 8, 2025 was still pending.
I got a letter or email about the Flagstar settlement. Is it real?
Official notice came from the Flagstar Settlement Administrator, P.O. Box 4427, Baton Rouge, LA 70821, or info@FlagstarSettlement.com. If in doubt, call 1-855-542-0397 rather than any number in the message.
I filed a claim. Do I need to do anything else?
Only if the administrator asks. The FAQ says it may request more information, and claims without a timely answer are treated as invalid. Keep your contact details current with the administrator.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Open Class Action Settlements
Settlements still accepting claims, with deadlines
Data Breach Settlement Calculator
Estimate what a data breach claim may pay
IDX Data Breach Letter
What an IDX credit-monitoring letter means
Bank of America MOVEit Settlement
A separate bank settlement over the 2023 MOVEit breach