loanDepot Data Breach Settlement: $25M

Individuals who received a personalized notice from loanDepot stating their personally identifiable information was potentially compromised during the January 2024 data breach.

Documents showing financial loss or response to the breach, such as bank statements, account records, receipts, credit reports, or identity restoration expenses.

loanDepot has agreed to a $25 million class action settlement to resolve allegations that it failed to protect consumer data during a January 2024 cyberattack. The breach reportedly exposed sensitive personal and financial information belonging to approximately 16.9 million individuals, including names, Social Security numbers, dates of birth, addresses, email addresses, phone numbers, and financial account details.

Plaintiffs in the class action lawsuit argue that loanDepot could have prevented the breach through better cybersecurity practices and staff training. Instead, they claim the mortgage lender’s failure to act left customer data vulnerable to malicious access and misuse.

loanDepot is a major online mortgage lender offering home purchase, refinance, and home equity services. While the company denies any liability, it agreed to settle to resolve the legal dispute without admitting wrongdoing.

Under the Terms of the Settlement

All eligible class members can choose between a base cash payment—estimated between $5.30 and $70.71 depending on participation—or reimbursement of up to $5,000 for out-of-pocket losses tied to the data breach. Reimbursable losses include fraud-related costs, professional service fees, credit freezes or monitoring expenses, replacement IDs, and other breach-related financial harm.

California residents may be eligible for additional compensation under the California Consumer Privacy Act (CCPA), with estimated payouts ranging from $14.90 to $149.04 based on claim volume.

In addition to financial relief, all class members are eligible for two years of free credit monitoring and identity theft protection services. These protections include monitoring for suspicious activity, identity restoration support, and insurance coverage of up to $1 million.

loanDepot also committed to enhancing its cybersecurity protocols, with planned improvements in data governance, threat detection, and cloud security valued at $9.34 million.