More than 1.5 million people whose personal data was exposed in a Flagstar Bank network breach can now file claims worth up to $25,000 each, but the window closes on August 11. The breach itself dates back to December 2021, when unauthorized access compromised sensitive customer information over a two-day period. A global settlement reached in the Angus class action consolidated years of litigation into a single resolution, and affected customers who do not act before the deadline risk forfeiting their share.
How 1.5 million Flagstar customers lost control of their data
Unauthorized actors accessed Flagstar Bank’s network on December 3 and 4, 2021, according to a breach notification filed with the Maine Attorney General. The bank did not discover the intrusion until June 2, 2022, nearly six months after the incident. That gap between the breach and its detection meant customer data sat exposed for an extended period before any protective steps could begin.
Flagstar notified affected consumers on June 17, 2022, and the same notification was submitted in California to the state Attorney General on the same date. The filings show that 1,547,169 individuals were affected in total, with 1,028 of those residing in Maine. The law firm Skadden submitted the notification on the bank’s behalf, and Flagstar offered two years of identity protection services to those whose data was compromised.
From class actions to a $31.5 million settlement fund
The December 2021 breach was not an isolated event for Flagstar. A separate incident occurred in January 2021, and the resulting litigation from both events spawned three sets of cyber-breach-related class actions, according to a quarterly filing with the SEC. Those cases were eventually consolidated into a single proceeding known as the Angus case.
The parties ultimately reached a global settlement covering both the January 2021 and December 2021 matters. The settlement fund totals $31.5 million, as reported in court filings and related disclosures. Individual class members can claim up to $25,000 depending on documented losses tied to the breach, including out-of-pocket expenses, time spent dealing with fraud or identity theft, and costs for credit monitoring beyond what Flagstar already provided.
For customers without documented losses, the settlement typically offers a smaller flat payment. The exact amount each person receives depends on how many valid claims are filed before the August 11 deadline. Because the fund is fixed, fewer claims generally mean larger individual payouts, while a high volume of claims can reduce the per-person recovery.
What Flagstar customers should do before August 11
Anyone who received a breach notification from Flagstar in mid-2022 is likely part of the settlement class. The first step is to check for the original notification letter, which would have arrived around June 17, 2022, and should confirm whether your information was involved in the December 2021 incident. If you no longer have the letter, you can usually verify eligibility through the official settlement website or by contacting the settlement administrator using the phone number or email address listed in public notices.
To file a claim, eligible customers generally need to complete a claim form, either online or by mail, before the August 11 deadline. Claimants seeking reimbursement for out-of-pocket losses must provide documentation, such as receipts, bank or credit card statements, or invoices that show expenses linked to the Flagstar breach. Those asking for compensation for time spent resolving issues related to the breach may be required to estimate the hours they devoted to tasks like calling financial institutions, updating account credentials, or monitoring credit reports.
Even if you did not experience identity theft or direct financial loss, it may still be worthwhile to submit a claim for the flat payment available to class members without documented damages. The settlement is designed to compensate all affected consumers for the risk and inconvenience created when their personal data was exposed, not only those who can show fraudulent charges or other concrete harm.
Customers who do nothing by August 11 will typically remain bound by the settlement’s release of claims but will not receive any payment. In other words, failing to act can mean giving up the right to sue Flagstar over this breach in the future while also missing out on compensation from the settlement fund.
Protecting yourself after the breach
Beyond filing a claim, Flagstar customers whose data was compromised should continue to take basic security steps. That includes reviewing bank and credit card statements for unfamiliar transactions, checking credit reports for new accounts opened without authorization, and promptly reporting any suspicious activity to financial institutions. The two years of identity protection services originally offered by Flagstar may have expired, so affected individuals may want to consider alternative monitoring options or at least place fraud alerts or credit freezes with major credit bureaus if they remain concerned about misuse of their information.
The settlement cannot undo the December 2021 breach or the months-long delay before it was discovered, but it does offer a path for more than 1.5 million people to recover some of the costs and disruption they have faced. With the claims window closing on August 11, acting now is the only way for eligible Flagstar customers to secure their share of the $31.5 million fund and take a concrete step toward addressing the fallout from the incident.
Free for readers: The free Retirement Shield newsletter sends plain-English help keeping more of your money in retirement — the scams to dodge, the benefits you’re owed, and what’s changing with Social Security and Medicare, a couple times a week. Get the free newsletter.
