Lennar Data Breach Lawsuit: A Mediator Was Picked on October 15 and an Amended Complaint Filed October 16 — but There Is Still No Settlement, and the Only Deadline Is Kroll’s November 20 Monitoring Cutoff

The short answer: the case has moved into mediation, but no settlement has been reached and there is nothing to claim. The consolidated lawsuit, Ramkissoon v. Lennar Corporation, No. 1:26-cv-25518, sits before Chief Judge Cecilia M. Altonaga in the U.S. District Court for the Southern District of Florida and names both Lennar Corporation and Lennar Mortgage, LLC. When we last wrote on October 14, the newest entry was the court’s October 7 order referring the case to a magistrate judge and to mediation, together with a scheduling order. Five more entries have appeared since.

The CourtListener docket index lists them by number, date and title: entry 59 on October 15, 2026, a “Notice of Mediator Selection and/or Hearing”; entry 60 the same day, an “Order Scheduling Mediation”; entries 61 and 62 on October 16, 2026, a “Stipulation” and an “Amended Complaint”; and entry 63 on October 19, 2026, a filing on an “Extension of Time to File Response/Reply/Answer.” In plain terms: the parties have picked a mediator, the court has put a mediation on the calendar, the plaintiffs have filed another amended complaint (the first one came on October 2), and Lennar’s deadline to answer or move to dismiss is the subject of an extension request.

What we cannot tell you is what those papers say. None of the documents behind entries 48 or 56 through 63 is in the public RECAP archive, and the court’s own system is behind PACER’s paywall. So the mediator’s name, the mediation date, what the two sides stipulated to and the new response deadline are not public in any source we could read. We will add them when the documents surface.

Not now, and possibly not for a long time. As of October 20, 2026 there is no Lennar data breach settlement: no class has been certified, no settlement agreement has been filed, no judge has granted preliminary approval, and there is no claim form, no claim deadline and no settlement website. A scheduled mediation is a meeting with a neutral go-between, not an agreement. If it does produce a deal, the order of events is fixed: the agreement is filed, the judge grants preliminary approval, a court-appointed administrator mails or emails notice, and only then does a claim window open.

How big the class could be is still disputed. The August 24 complaint, according to Mortgage Professional, says “Lennar reported that at least 61,295 people were affected” and puts the amount in dispute above $5 million. National Mortgage News reported that the Smedick complaint against Lennar Mortgage seeks a class of “approximately 348,416, the number of potentially affected individuals Lennar Mortgage originally reported.” Lennar’s spokesperson did not give a nationwide total in the first National Mortgage News report, but a later report says Lennar reported 6,643 affected individuals for the March incident and that Smedick’s proposed class of about 348,416 is the number Lennar Mortgage originally reported.

What is the typical payout per person for a data breach settlement? There is no fixed rate; it depends on the fund, the class size and how many people claim. National Mortgage News listed this year’s mortgage-industry breach deals: Bayview Asset Management, $26 million for over 5.7 million consumers; AnnieMac, $2 million for 171,074 class members; SitusAMC, $5.3 million for 662,792; NJ Lenders, $100,000 for about 30,000. Divided across the whole class, that is roughly $4.56, $11.69, $8.00 and $3.33 per person before fees and costs — our arithmetic. Actual checks are usually larger because only a fraction of class members file, and settlements of this kind typically pay more to people who document out-of-pocket losses. None of those numbers says anything about what Lennar would pay.

How to check for a data breach? For this one, the answer is in your mailbox. Lennar sent notice letters through Kroll; for Lennar Corporation, its filing with the Nebraska Attorney General says letters were “scheduled to be mailed to potentially impacted individuals on August 11, 2026,” with a legal notice in USA Today and on lennar.com the same day. If you are unsure whether you were included, call the number in the letters: (844) 958-8940 for Lennar Corporation (the March 24–30, 2026 intrusion) or (844) 958-8939 for Lennar Mortgage (the May 26–June 1, 2026 intrusion), Monday through Friday, 9:00 a.m. to 6:30 p.m. Eastern. For other companies, the California Attorney General keeps a searchable list of sample breach notices sent to more than 500 California residents.

The one real deadline is for the free monitoring, not for a settlement. The letters offer two years of Kroll identity monitoring — single-bureau credit monitoring, fraud consultation and identity theft restoration — activated at enroll.krollmonitoring.com with the membership number printed in your letter. HousingWire reported that Lennar Mortgage recipients “have until Nov. 20, 2026, to activate the identity monitoring services.” The sample letters on file with California leave the date as a blank field, so go by the date in your own letter; Lennar Corporation recipients in particular should check theirs, because we could not confirm their deadline from a primary source.

Beyond that: keep the letter, because a future claim form will ask you to show you were notified; consider a credit freeze at Equifax, Experian and TransUnion, which the letters say is free of charge — though, as they also warn, it may delay a new loan or credit application, which matters if you are mid-mortgage; and keep records of any fraudulent charges, reports to the FTC or police, and the time you spend dealing with them. You do not need to hire a lawyer or join a lawsuit to be included if a class settlement is later approved.

Right now, any message saying you are owed money from a Lennar data breach settlement is not from the court. There is no court-approved notice to send, because there is no settlement. Treat as suspect any email, text or website that asks for your Social Security number, bank login or a fee to “register” or “secure” a Lennar payment. Law-firm “investigation” pages asking you to sign up are recruiting clients, which is legal, but signing up with them is not filing a claim.

The genuine contacts are narrow: the letter itself, the two (844) numbers above, and Kroll’s enrollment site. The letter says Lennar is “not aware of any misuse of your sensitive personal information” and asks recipients to have their membership number ready when they call; activation runs through the membership number in your letter, not through anyone who contacts you first. Our Kroll page explains what its real breach letters and monitoring emails look like. If a court-appointed settlement administrator is ever named, its site will be listed in a court-approved notice and in the court record — we will link it here.

The plaintiffs allege that Lennar failed to protect personal data that customers, borrowers and employees handed over to buy and finance homes. Both companies told regulators that an “unauthorized party used sophisticated social engineering tactics” to get into their systems — Lennar Corporation between March 24 and March 30, 2026 (assessment finished July 30), Lennar Mortgage between May 26 and June 1, 2026 (assessment finished August 4). The data, per the Nebraska filing, may have included names, contact information, dates of birth, Social Security numbers, passport or other government ID information, driver’s license numbers and financial account information. Lennar calls them “two separate, and we believe, unrelated social engineering-based cybersecurity events.”

The complaints plead negligence and related claims. One of the August cases, DiMeglio v. Lennar Corporation, No. 1:26-cv-25575, alleges negligence and negligence per se and claims Lennar “failed to adequately train employees on phishing, social engineering and ransomware attacks.” The August 24 complaint, as Mortgage Professional describes it, brings negligence, breach of an implied contract and unjust enrichment, and treats the gap between the first intrusion and the first notice as a failure of its own. These are allegations; Lennar has not admitted them, and its regulator filing says it “does not admit or concede any liability or wrongdoing.” The Lennar data breach is not the only breach the search turns up. Did UnitedHealthcare have a data breach? That is a separate matter this page does not cover: the parties to the Lennar case are Lennar Corporation, Lennar Mortgage and the plaintiffs, and UnitedHealthcare is not one of them. The California Attorney General’s breach list is a good place to look up any other company’s notice.