Business

Flagstar Bank Customers Have 8 Days Left to Claim Up to $25,000 From a Data Breach Settlement

By Erica Coleman · August 3, 2026

More than 2 million people are eligible. The deadline is August 11. Most of them don’t know it exists.

Flagstar Bank agreed to pay $31.5 million to settle a class action lawsuit alleging it failed to protect customer data during two separate cyberattacks in 2021. The claim portal is open at flagstarsettlement.com, and the deadline to file is one week from today.

The breaches exposed the personal information of approximately 2,187,170 people across the United States — including names, Social Security numbers, and financial account details. This wasn’t a retailer losing your email address. This was a bank losing the data that enables identity theft.

Here’s what eligible claimants can receive.

If you suffered documented financial losses — fraudulent charges, identity theft recovery costs, credit repair fees — you can claim reimbursement up to $25,000 with supporting documentation such as bank statements, receipts, or invoices. If you didn’t suffer provable financial losses but your data was exposed, you’re still eligible for a residual cash payment estimated at approximately $60 with no documentation required beyond your claim ID. California residents can claim an additional CCPA statutory payment of up to $100.

All claimants are also eligible for three years of free three-bureau credit monitoring through IDX, which includes $1 million in identity theft insurance, dark web monitoring, and identity restoration services.

Filing requires a Settlement Claim ID — a unique identifier included in the notice mailed or emailed to every identified class member. If you received a letter from the Flagstar Settlement Administrator and threw it away thinking it was junk mail, you can still file by contacting the administrator at 1-855-542-0397 or visiting flagstarsettlement.com.

The breaches occurred in January and December 2021. Flagstar, which was later acquired by New York Community Bank, used a file-transfer technology called Accellion FTA that was exploited by hackers in a widespread attack affecting roughly 300 organizations. The second breach occurred through a separate intrusion later that year.

Flagstar denied wrongdoing. The final approval hearing is scheduled for October 1, 2026.

The settlement administrator will distribute payments after the court grants final approval and resolves any appeals. Filing takes roughly 5 to 10 minutes for the residual cash claim and 15 to 20 minutes for documented losses.

Eight days. That’s what’s left. The portal closes August 11.