SoFi Data Breach Lawsuit: What Customers Should Know
A class action is moving through federal court in California over a late-2025 breach affecting at least 38,049 people. There is no settlement, no claim form and no deadline yet — this page tracks the case and tells you what is worth doing in the meantime.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What the Lawsuit Alleges
On 27 February 2026, plaintiff Joshua Cook filed a class action against SoFi Technologies, Inc. in the U.S. District Court for the Northern District of California. The complaint alleges SoFi failed to reasonably secure customer information during a breach in late 2025, exposing the data of at least 38,049 individuals. The information involved is described as including names, dates of birth, addresses, email addresses, phone numbers, and employment and education information. The complaint asserts seven counts, among them negligence, breach of contract and violation of the Illinois Consumer Fraud Act, and seeks damages, lifetime credit monitoring funded by SoFi, and injunctive relief requiring better security.
Case Details
The case is captioned Cook v. SoFi Technologies, Inc., No. 3:26-cv-1722 (N.D. Cal.). As of 24 August 2026 it sits at the earliest stage: no class has been certified, no settlement has been proposed, and no claims portal exists. That sequence matters — certification comes first, and only then does any settlement discussion become meaningful. Additional suits over the same breach may be filed and consolidated, which is the normal pattern and typically adds months before anything is resolved.
Status as of 24 August 2026
Who May Be Affected
The complaint identifies at least 38,049 individuals — SoFi customers whose information was in the affected systems. SoFi operates across lending (student loan refinancing, personal loans, mortgages), banking and investing, so the affected group may span several product lines. If you received a breach notification from SoFi, keep it: it identifies which of your data elements were involved and is your evidence of class membership if the case reaches a settlement. If you are a SoFi customer and received nothing, that likely means your records were not in the affected set — but reviewing your account activity costs nothing and is sensible either way.
What Compensation Could Look Like
How the Case Is Developing
- 1
Late 2025 — the breach
Customer information is exposed. The complaint describes names, dates of birth, addresses, contact details and employment and education information.
- 2
27 February 2026 — class action filed
Cook v. SoFi Technologies, Inc. is filed in the Northern District of California, asserting seven counts including negligence and breach of contract.
- 3
Expected — consolidation
Where multiple suits are filed over one breach, courts typically consolidate them into a single action. This routinely adds months before substantive progress.
- 4
Class certification
The court must certify a class before the case can resolve on a classwide basis. As of 24 August 2026 no class has been certified.
- 5
24 August 2026 — where things stand
Active litigation at an early stage. No settlement, no administrator, no claim deadline. This page is updated as the case develops.
Three Things to Ignore
A fintech breach with no official process yet is exactly the gap impostors work.
“File your SoFi claim now”
No settlement exists and no administrator has been appointed. Any claim form for this breach today is fake, and one asking for your banking details is the fraud itself.
Calls or emails “from SoFi security”
The exposed data — name, date of birth, address, employer — is precisely what makes a scam call sound legitimate. SoFi does not call asking you to confirm credentials or move money. Hang up and use the number on the official app or website.
Paying for credit monitoring because of this breach
Credit freezes at Equifax, Experian and TransUnion are free by law and stronger than paid monitoring. Check any breach notice you received first — free monitoring is commonly offered.
Common Questions
Can I file a claim now?
No. The case was filed in February 2026 and is at an early stage — no class certified, no settlement, no claims portal. If a settlement is reached, a court-appointed administrator will notify class members directly.
What data was exposed?
According to the complaint: names, dates of birth, addresses, email addresses, phone numbers, and employment and education information of at least 38,049 people. The reporting does not indicate account credentials were taken, but that combination still supports identity fraud.
Should I close my SoFi account?
Closing an account does not remove data already exposed, and it may complicate your position if a settlement is defined by customer status. The more useful steps are freezing your credit, enabling two-factor authentication, and monitoring statements for unfamiliar activity.
Can I join the lawsuit?
Class actions do not require you to join. If a class is certified and covers you, you are included automatically and will receive notice; you would then choose to file a claim or opt out. Contacting a firm investigating the case costs nothing and is optional.
What is “lifetime credit monitoring” in the complaint?
A remedy the plaintiff is asking the court to order — monitoring funded by SoFi for the duration of the class members' lives rather than the usual one to three years. It is a request, not an entitlement, and settlements commonly land on shorter terms.
How long will this take?
Comparable data breach class actions have run two to four years from filing to payment. This one was filed in February 2026, so any distribution realistically falls in 2028 or later — assuming it settles at all.
How do I verify this page?
Through the public docket for Cook v. SoFi Technologies, Inc., No. 3:26-cv-1722 (N.D. Cal.), and any notice you received from SoFi. Details here reflect what we could confirm as of 24 August 2026.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.