OneMain’s PII Exposed Breach: Oregon’s Record Says the Lender Discovered It on August 18, 2026 — Data Was Taken May 5, Letters Went Out September 28. As of October 19, Still 11 Lawsuits and No Settlement; Credit Monitoring Closes December 31, 2026.

If OneMain’s “Notice of Data Breach” is in your mailbox, the money answer as of October 19, 2026 is the same as it was a week ago: no court has approved a settlement, no administrator has been named, and there is no claim form and no payment date. The new information is about timing. In its filing with the Oregon Department of Justice, OneMain lists the dates of the breach as “5/5/2026 - 5/12/2026,” the date discovered as “8/18/2026” and the date notice was provided as “9/28/2026.” Oregon counts 960 affected people in that filing.

Those dates do not line up with the other official record. OneMain’s filing with the California Attorney General gives the dates of breach as “Tuesday, May 5, 2026” to “Friday, May 8, 2026,” and the sample letter filed there says: “In May, OneMain discovered unauthorized activity on its systems,” and that “data containing personal information was accessed or aquired on May 5, 2026” [sic]. The letter does not mention August 18. One possible reading is that May is when OneMain saw the intrusion and August 18 is when it established that personal data was involved; OneMain has not said so publicly, and we do not know which is right. What the records do show: data taken on May 5, a discovery date of August 18 in Oregon’s file, and letters dated September 28, 2026 — 41 days after that discovery date and almost five months after the data was taken.

How long does it take to report a PII breach? It depends on which law applies, and there is no single figure for every PII exposed breach. For health information held by HIPAA-covered entities, federal rules require notice to individuals “without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.” Under the UK GDPR, the Information Commissioner’s Office says an organisation must report a notifiable breach to the regulator “without undue delay, but not later than 72 hours after becoming aware of it.” OneMain is a consumer lender, not a hospital or a UK company, so neither rule is the yardstick here; the state breach laws that do govern its notices are what the Maryland plaintiffs will argue over, and we could not read those statutes on October 19, 2026. Measured from the Oregon discovery date, OneMain took 41 days; measured from the day the data was taken, more than four months.

What is considered a personal data breach under GDPR? The ICO’s definition: “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.” That is UK and European law; it does not decide anything for U.S. OneMain customers, whose cases are in federal court in Maryland. For questions about a UK or EU breach, the regulator to contact is the ICO or your national data protection authority, not this page.

The court index on CourtListener, read on October 19, 2026, lists 11 cases against OneMain Financial Group filed in the District of Maryland from September 28 to October 12, 2026 — the same 11 we counted on October 15. No case filed after October 12 appears there. Five are before Judge Adam B. Abelson, including the first-filed Harris case and Fedorchak (No. 1:26-cv-03845), which was reassigned to him on September 30; two are before Judge Brendan Abell Hurson; one, Gordon, is directly assigned to Magistrate Judge Erin Aslan; three show no judge. The index labels Velazquez (No. 1:26-cv-04052) “COMPLAINT (Class Action)” and lists Gordon under the “Class Action Fairness Act.” Everything the plaintiffs say about OneMain’s security, including that the data was unencrypted, is an allegation; no court has ruled on it.

We found no motion to consolidate the cases and no appointment of interim class counsel in the entries available to us. That is not proof that none exists: CourtListener does not carry every docket entry, and our access to it was limited on October 19, 2026. The summonses in the early cases were issued as “Summons Issued 21 days”, meaning OneMain’s response clock runs from service, which the public entries do not show. A settlement, if one comes, needs a judge’s preliminary approval before any notice, claim form or deadline exists, and in data-breach cases notice normally goes to the people on the company’s mailing list.

The deadline that matters is in the letter: 24 months of credit monitoring and identity restoration through TransUnion, activated with the code printed on your letter at bfs.cyberscout.com/activate. The letter says: “Ensure that you enroll by December 31, 2026 (Your code will not work after this date.)” The enrollment deadline is December 31, 2026.

Beyond that, the letter points to free credit reports at annualcreditreport.com or (877) 322-8228, a fraud alert or security freeze with the three bureaus — “A credit reporting agency may not charge you to place, temporarily lift, or permanently remove a security freeze” — and the FTC at +1 (877) 438-4338. Questions about the incident go to OneMain’s line, 1-833-516-9566, Monday through Friday, 8 a.m. to 8 p.m. Eastern Time.

The genuine letter is headed “NOTICE OF DATA BREACH,” is dated September 28, 2026, comes from c/o Cyberscout, PO Box 1286, Dearborn, MI 48120-9998, and is signed by OneMain Financial Group, LLC, P.O. Box 1170, Evansville, IN 47706-1170, 1-888-846-0332. It asks for no payment and mentions no settlement. The letter is sent c/o Cyberscout and the enrollment link is on a Cyberscout site, so the Michigan return address matches the letter’s own enrollment instructions.

Because there is no settlement as of October 19, 2026, any email, text or call offering “OneMain settlement money,” charging a fee to join a class action, or asking for your Social Security number to check eligibility is not from a court-approved process. Law-firm ads asking breach victims to sign up are solicitations, not settlements. If in doubt, call the number printed on your letter.

How many people were hit is still not public in any official national figure we could read. teiss, citing state filings, reported at least 15,472 Texas residents, 1,516 South Carolina residents and 960 Oregon residents — “more than 17,000 customers across several states” — and that the exposed data “included names, addresses, Social Security numbers and other account-related information.” In the public sample letter one item in the list of information is blacked out. Larger totals circulating online are unconfirmed.

The August 18 date matters for more than curiosity. How quickly a company warned its customers is one of the points the Maryland complaints are likely to press, and Oregon’s record is the first official document we have seen that puts a discovery date on paper. For readers, nothing changes: there is no money to claim yet, and the only action with a deadline is the credit-monitoring enrollment.