OneMain Financial’s Data Breach: Data Taken May 5, Letters Dated September 28, 2026, At Least Two Federal Lawsuits in Maryland — but No Settlement and No Claim Form. The Only Thing With a Deadline Is Free Credit Monitoring: Enroll by December 31, 2026.

If a “Notice of Data Breach” from OneMain Financial arrived in your mailbox, you are part of a PII exposed breach that is real, documented with state regulators — and, as of October 13, 2026, worth no cash to anyone. There is no settlement, no settlement administrator, no claim form and no payment date. What exists is a set of lawsuits filed in Maryland federal court in the last days of September, which have not been ruled on, and a free credit-monitoring offer in the letter itself.

OneMain’s own account, from the sample letter it filed with the California Attorney General: “In May, OneMain discovered unauthorized activity on its systems. We acted quickly to stop the activity, and took steps to enhance our security measures.” A forensic firm then found that “data containing personal information was accessed or aquired on May 5, 2026.” The company adds: “There was no evidence of any unauthorized access to customer accounts,” and that it has “not received any reports of actual fraud or identity theft related to this incident.” The California filing gives the breach window as May 5 to May 8, 2026 and the report date as September 25, 2026; the letters are dated September 28, 2026, almost five months after the data was taken.

What is a PII breach? PII is personally identifiable information. The National Institute of Standards and Technology defines it as “information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual” — NIST’s examples include name and Social Security number. A PII breach is an incident in which that kind of information is accessed or taken by someone not authorized to have it, which is what OneMain’s letter describes.

The letter says: “We have determined that your name, address, […] and other account related information were affected.” In the public sample one item in that list is blacked out, so the official file does not show it. teiss, citing the state filings, reports that the exposed information “included names, addresses, Social Security numbers and other account-related information” and counts at least 15,472 Texas residents, 1,516 South Carolina residents and 960 Oregon residents — “more than 17,000 customers across several states.” We could not open the Texas portal or the Oregon list ourselves, and no official nationwide total has been published that we could verify; larger figures circulating online are unconfirmed.

This is not OneMain’s first filing. The California list also shows an earlier OneMain incident dated July 22 to August 8, 2022, reported on September 23, 2022. Separately, OneMain disclosed in an SEC filing that on May 24, 2023 it entered a consent order with the New York State Department of Financial Services over a past examination of its cybersecurity policies from 2017 to early 2020, agreeing to a $4.25 million civil penalty. Neither of those is part of the 2026 breach.

The cases were filed in the U.S. District Court for the District of Maryland. The court record we could read locally shows Harris v. OneMain Financial Group LLC, No. 1:26-cv-03823, with the complaint entered on September 28, 2026, assigned to Judge Adam B. Abelson, and a summons issued on September 29; and Fedorchak v. OneMain Financial Group, LLC, No. 1:26-cv-03845, filed on September 29, 2026. We have not read the complaints, so we cannot say whether either seeks class status. Other sites report more cases in the same court; we have not confirmed the number, and we could not open the complaints themselves, so we do not repeat their allegations here. Any claim that OneMain failed to encrypt data or acted negligently is the plaintiffs’ accusation, not a finding.

What happens next in cases like this is routine. Several suits over the same breach in one court are usually consolidated under one lead case, the company answers or moves to dismiss, and only then do settlement talks, if any, begin. A settlement needs preliminary approval by the judge before any notice, claim form or deadline exists. Until that happens, nobody can tell you an amount. You do not need to sign up anywhere to be included in a future class: if a settlement is reached, notice normally goes to the people on the company’s breach list.

For anyone searching “PII exposed breach what to do,” OneMain’s letter gives the steps. Credit monitoring: the letter offers 24 months of credit monitoring and identity restoration through TransUnion, enrolled with the unique code printed on your letter at bfs.cyberscout.com/activate. The letter is explicit: “Ensure that you enroll by December 31, 2026 (Your code will not work after this date.)” The enrollment deadline is December 31, 2026.

Credit reports: free reports are available at annualcreditreport.com or toll-free at (877) 322-8228. Fraud alert or freeze: the letter lists the three bureaus and notes that “a credit reporting agency may not charge you to place, temporarily lift, or permanently remove a security freeze.” Identity theft: report it to the FTC at +1 (877) 438-4338 and to local police, as the letter recommends.

Questions about the incident go to OneMain’s dedicated line, 1-833-516-9566, 8 a.m. to 8 p.m. Eastern Time on weekdays, according to the letter.

The real letter matches the sample on file in California: it is headed “Notice of Data Breach,” carries the return address One Main Financial, c/o Cyberscout, PO Box 1286, Dearborn, MI 48120-9998, and is signed by OneMain Financial Group, LLC, P.O. Box 1170, Evansville, IN 47706-1170, 1-888-846-0332. The letter names TransUnion as its monitoring vendor and routes mail and enrollment through Cyberscout, so a Michigan return address is expected. The only enrollment address in the letter is bfs.cyberscout.com/activate, with the code printed on your letter.

The letter does not ask for payment and does not mention any settlement. Any email, text or call that offers you OneMain “settlement money,” charges a fee to “join” the class action, or asks for your Social Security number to check eligibility does not come from the court process, because no settlement exists as of October 13, 2026. If in doubt, call OneMain at the number in the letter rather than any number in an unsolicited message.