OneMain Financial Data Breach: 11 Lawsuits Filed in Maryland Federal Court Between September 28 and October 12, 2026 — Still No Settlement, No Claim Form and No Refund. The Only Deadline Is Credit Monitoring: Enroll by December 31, 2026.

If you received OneMain’s “Notice of Data Breach” and are searching for a OneMain Financial data breach refund or settlement: as of October 15, 2026 there is none. No court has approved a settlement, no administrator has been appointed, and there is no claim form and no payment date. What has changed since our first report on October 13 is the size of the litigation. We counted two federal cases then. A search of the court index on CourtListener on October 15, 2026 shows 11 cases against OneMain Financial Group in the District of Maryland filed in a fifteen-day stretch: two on September 28, two on September 29, one on September 30, four on October 1, one on October 2 and one on October 12, 2026.

The breach itself is documented in OneMain’s filing with the California Attorney General: dates of breach May 5 and May 8, 2026. The company’s sample letter, dated September 28, 2026, says: “In May, OneMain discovered unauthorized activity on its systems,” and that “data containing personal information was accessed or aquired on May 5, 2026” [sic]. It adds: “There was no evidence of any unauthorized access to customer accounts,” and that OneMain has “not received any reports of actual fraud or identity theft related to this incident.” The letter lists “your name, address, […] and other account related information”; one item is blacked out in the public sample. The Harris complaint alleges that the data included “names, addresses, and Social Security numbers.”

All 11 cases were filed in the U.S. District Court for the District of Maryland in Baltimore, where the complaint places OneMain Financial Group, LLC at 1501 S Clinton St. As indexed on October 15, 2026: Harris (No. 1:26-cv-03823, filed September 28, Judge Adam B. Abelson); Chess (No. 1:26-cv-03826, September 28, Judge Brendan Abell Hurson); Fedorchak (No. 1:26-cv-03845, September 29, reassigned to Judge Abelson on September 30); Adams (No. 1:26-cv-03860, September 29); Velazquez (No. 1:26-cv-04052, September 30, Judge Abelson); a complaint by three plaintiffs indexed as Stewart v. Merino (No. 1:26-cv-04086, October 1, Judge Abelson); Longoria (No. 1:26-cv-04109, October 1, Judge Hurson); Clayton (No. 1:26-cv-04117, October 1, Judge Abelson); Gordon (No. 1:26-cv-04141, October 1, Magistrate Judge Erin Aslan); Delapaz (No. 1:26-cv-04149, October 2); and Brewer (No. 1:26-cv-04265, October 12). Three of the cases had no judge shown in the index.

We read the Harris complaint, 27 pages. It is styled “COMPLAINT – CLASS ACTION” with a jury demand and proposes a “Nationwide Class: All individuals residing in the United States whose Private Information was accessed and/or acquired by an unauthorized party in the Data Breach.” It pleads four counts: negligence, negligence per se, breach of implied contract and unjust enrichment, and claims federal jurisdiction under the Class Action Fairness Act because “the amount in controversy exceeds $5 million.” Its central allegation: “The Data Breach resulted in unauthorized third-party accessing and acquiring files containing unencrypted Private Information.” That is the plaintiff’s accusation, not a finding; OneMain has not filed a response in any of the cases we could see. For readers searching “OneMain Financial breach of contract”: the contract theory in these cases is about data security. The court index lists Velazquez’s nature of suit as “Breach of Contract” and Chess’s as “Other Contract,” and docket entries mark Velazquez and Gordon as class actions. We could not read the other complaints, so for eight of the 11 we rely on timing, captions and docket labels.

When a single breach produces this many suits in one court, the usual next step is a motion to consolidate them under one lead case and to appoint interim class counsel. Five of the cases are already before Judge Abelson, including the first-filed Harris case. As of October 15, 2026 we found no consolidation motion or order in the docket entries available to us; CourtListener does not carry every entry, so that is unconfirmed rather than a sign that nothing has been filed. In the Gordon case, the docket listed a magistrate-judge election form as due by October 19, 2026 (as of October 15, 2026).

After consolidation comes a combined complaint, then OneMain’s answer or motion to dismiss. Settlement talks, if any, come later, and any settlement needs a judge’s preliminary approval before a notice, claim form or deadline exists. Nobody can put a dollar figure on a OneMain payout today. You do not need to sign up with a law firm to be covered by a future class settlement: in data-breach cases notice normally goes to the people on the company’s notification list.

The only deadline that matters today is in OneMain’s own letter. It offers 24 months of credit monitoring and identity restoration through TransUnion, activated with the unique code printed on your letter at bfs.cyberscout.com/activate. The letter says: “Ensure that you enroll by December 31, 2026 (Your code will not work after this date.)” The enrollment deadline is December 31, 2026.

Beyond that, the letter recommends watching your financial accounts, free credit reports, and a fraud alert or security freeze with the three credit bureaus, and contacting local police if you suspect identity theft. Questions about the incident go to OneMain’s dedicated line, 1-833-516-9566, Monday through Friday, 8 a.m. to 8 p.m. Eastern Time.

The genuine letter matches the sample on file in California: headed “Notice of Data Breach,” with the return address c/o Cyberscout, PO Box 1286, Dearborn, MI 48120-9998, signed by OneMain Financial Group, LLC, P.O. Box 1170, Evansville, IN 47706-1170, 1-888-846-0332. Cyberscout handles the mailing and enrollment for TransUnion, so the Michigan address is expected. The letter does not ask for money and does not mention any settlement.

Because no settlement exists as of October 15, 2026, any message that promises a “OneMain data breach refund,” charges a fee to join a class action, or asks for your Social Security number to check eligibility does not come from a court-approved process. Law-firm advertisements asking breach victims to sign up are lawful solicitations, not settlements. If in doubt, call the number printed in your letter, not one in an unsolicited email or text.

Is OneMain Financial a bank? No. The Consumer Financial Protection Bureau describes it as “a nonbank personal loan installment lender headquartered in Evansville, Indiana.” OneMain’s 2025 annual report describes a lender serving nonprime consumers under state licensing, with “approximately 3.6 million customer accounts,” more than 1,300 branches and operations in 48 states; its BrightWay credit cards are issued “through a third-party bank partner.”

Is OneMain Financial a predatory lender? That is a judgment we cannot make; the record shows two regulatory actions in 2023, neither about the 2026 breach. The CFPB ordered OneMain to pay $20 million — $10 million in refunds and a $10 million penalty — over add-on products, finding it failed to refund interest to 25,000 customers who cancelled within a “full refund” period; those 2023 refunds are unrelated to the data breach. And on May 24, 2023, the New York Department of Financial Services entered a consent order with a $4.25 million civil penalty over OneMain’s cybersecurity program, after an examination beginning with the period from December 31, 2016. Whether the 2026 breach reflects similar gaps is exactly what the Maryland plaintiffs allege and OneMain has not yet answered.