Lennar Data Breach Lawsuit Referred to Mediation on October 7, 2026 — After a Consolidation Order and a Ruling on Lead Lawyers. There Is Still No Settlement and No Claim Form.

When we last wrote about the Lennar data breach on September 9, the lawsuits were scattered across several judges in the Southern District of Florida, Chief Judge Altonaga had twice declined to appoint lead lawyers because Lennar had not appeared, and no consolidation order existed. Five weeks later the docket looks different. On September 15 she signed an order in Todd v. Lennar Corporation, filed August 28, that reads: “ORDERED that Case Number 26-cv-25939 is CONSOLIDATED with Case Number 26-cv-25518 for all purposes. The Clerk of Court shall CLOSE Case Number 26-cv-25939. All future filings in these related actions shall be made under Case Number 26-cv-25518 only.” The docket entry calls it the “Forth Order Consolidating Case”. The court gave its reason in one line: the cases are “proposed class actions against Defendants Lennar Mortgage, LLC and Lennar Corporation for damages arising out of the alleged breach of data security and theft of Plaintiffs’ personally identifiable information,” and consolidating them avoids “unnecessary duplication.” Bensfield v. Lennar Corporation, filed August 24 and first assigned elsewhere, is now listed under Chief Judge Altonaga too.

The Ramkissoon docket index on CourtListener shows what followed. Lennar asked for more time on September 18, and an order on that motion was entered September 21; Lennar’s corporate disclosure statements were filed September 23. A motion to appoint counsel was docketed September 23 and an “Order on Motion to Appoint Counsel” followed on September 24. On October 2 the parties filed a “Scheduling Report – Rule 26(f)/16.1” — the joint plan lawyers file after they have conferred — and an entry in the category “Amended Complaint.” On October 7 the court entered entry 58: “Order Referring Case to Magistrate Judge AND Order Referring Case to Mediation AND Scheduling Order.”

We could not read entries 48, 57 or 58. They are not in the public RECAP archive, and the court’s own system is behind PACER. So we do not know who the court picked as interim class counsel, whether the October 2 filing is a single consolidated complaint, or what dates the scheduling order set for mediation, motions or trial. We will add them when the documents become public.

Not by itself. A referral to mediation is an order to sit down with a neutral mediator at some point under the schedule; it is not an agreement, and the docket title says nothing about when. Nothing on the docket is a settlement. No class has been certified. Lennar has not admitted the allegations; its notice letters say the company is “not aware of any misuse of your sensitive personal information,” and a spokesperson told National Mortgage News that “There was no operational impact from these events.”

If the parties do settle, a judge must first grant preliminary approval; only then does a court-appointed administrator send notice, open a claim form and set a deadline. None of that has happened. As of October 14, 2026 there is no Lennar settlement website, no claim number and no claim deadline — anyone telling you otherwise, or asking for a fee or your Social Security number to “register,” is not the court and not Lennar.

How many people a settlement would cover is also unsettled. The August 24 complaint, according to Mortgage Professional, says “Lennar reported that at least 61,295 people were affected” and puts the amount in dispute above $5 million. National Mortgage News reported that the Smedick complaint against Lennar Mortgage seeks a class of “approximately 348,416, the number of potentially affected individuals Lennar Mortgage originally reported,” and described the two breaches as having “over 350,000 potential victims.” We could not find the 348,416 figure on any state breach registry, and Lennar has not published a national total.

Lennar notified people by mail, through Kroll. The letters say an “unauthorized party used sophisticated social engineering tactics” to get in — at Lennar Corporation between March 24 and March 30, 2026 (review finished July 30), and at Lennar Mortgage between May 26 and June 1, 2026 (review finished August 4). The California Attorney General’s registry lists both: Lennar Corporation reported August 11, 2026, and Lennar Mortgage, LLC August 14, 2026. If you did not get a letter and want to check, the numbers printed in the letters are (844) 958-8940 for Lennar Corporation and (844) 958-8939 for Lennar Mortgage, Monday through Friday, 9:00 a.m. to 6:30 p.m. Eastern.

The letter is what matters now. It offers two years of Kroll identity monitoring — single bureau credit monitoring, fraud consultation and identity theft restoration — activated at enroll.krollmonitoring.com with the membership number in the letter, before the activation deadline printed in the letter. Both letters also explain that a credit freeze is “free of charge.” Keep the letter: when the plaintiffs in Bensfield sued, they attached the notice letter to the complaint as Exhibit 1, and any future claim form will ask you to show you are in the class. Keep a file of fraudulent charges, police or FTC reports and time spent; data breach settlements usually pay documented losses against paperwork. Our Kroll page explains what genuine Kroll emails and letters look like.

Yes, people do, and that is what is happening here: the cases are brought by individual customers and borrowers “individually and on behalf of all others similarly situated,” as the captions put it, which makes them proposed class actions. You do not need to file your own suit to benefit if a class is later certified or a settlement approved; class members are notified and file a claim. Filing your own case is possible but would now be consolidated into the same docket in Miami.

The Lennar controversy behind the search is the breach itself: two intrusions at one of the country’s largest homebuilders and its mortgage arm in the spring of 2026, notice letters mailed in August that the complaints allege came months late, and Social Security numbers and financial account data in mortgage files. Lennar calls them “two separate, and we believe, unrelated social engineering-based cybersecurity events.” The California registry also lists an earlier Lennar Corporation incident dated July 20, 2023. A check of federal court records for Lennar cases filed since September 1, 2026 turned up no new data breach suits; a September 18 case against Lennar Mortgage is an employment case under the disability laws, not part of this litigation.