“A bank data breach is the dangerous kind. It hands a thief the exact keys — your account number, your routing number, your Social Security number — they need to open new credit in your name, not just steal what’s already there.”
And if you ever filed a Facebook privacy claim, watch for the surprise second Facebook settlement payment that started going out in June 2026 — millions of people have a second payment coming and most won’t notice.
If you were a Flagstar Bank customer affected by the 2021 data breaches, there’s a $31.5 million class action settlement open right now — and the claim deadline is August 11, 2026. The settlement website is live, filing takes a few minutes, and most people who qualify will toss the notice thinking it’s junk mail.
I’m writing this because of what kind of data was exposed here. This wasn’t a retail store losing your email address. This was a bank — and the information that leaked is the skeleton key for identity theft. That changes what you should do after you file your claim.
Claiming money you are owed is one good day. What you do over the following year is what actually changes your position.
In the latest issue (Oct 14): Do you want the money back you left behind?
Each weekday I send one short email: one money story that caught my attention, why it might matter to you, and one manageable thing you can do with it.
Free. I sell nothing. Unsubscribe any time.
I’ve covered settlement after settlement quietly come and go — most recently the Labcorp medical data breach settlement. The playbook is always the same: file your claim, then protect yourself from the real damage that arrives months later.
What You Need to Know — The Breach and the Settlement
Flagstar Bank suffered two data breaches in January 2021 and December 2021. According to the official settlement website, the breaches exposed the personal information of approximately 2,187,170 people across the United States, including about 364,000 California residents.
The Daily Money Brief — Free, at 10 AM
Money you may be owed, scams to dodge, and the fine print decoded — the consumer money news that affects your wallet, every weekday.
The data that may have been compromised includes the kind of information that does the most damage in the wrong hands — names, Social Security numbers, and financial account details. Flagstar denies wrongdoing but agreed to pay $31.5 million to settle the claims. The case is Angus et al. v. Flagstar Bank, N.A., Case No. 2:21-cv-10657-MFL-DRG, in the U.S. District Court for the Eastern District of Michigan.
Who Qualifies
You may be eligible if your personal information was compromised in the January 2021 or December 2021 Flagstar data breaches. The settlement administrator mailed or emailed a notice — with a Settlement Claim ID — to every identified class member. You may still be in the class even if you closed your Flagstar account years ago. If you think you were affected but aren’t sure, check the settlement website or call the administrator — don’t assume you’re out.
What You Can Claim
- Up to $25,000 for documented out-of-pocket losses — money you spent on identity theft remediation, fraud you had to clean up, credit monitoring you paid for, and time you lost dealing with the fallout.
- A cash payment estimated at about $60 (and potentially up to $599 depending on claims) with no documentation required — the easiest option for most people.
- Three years of free three-bureau credit monitoring, available to all eligible class members.
- California residents: an additional statutory payment of up to $100 under the California Consumer Privacy Act.
Key Deadlines
- File your claim: August 11, 2026
- Opt out or object: June 29, 2026 (only if you want to keep your right to sue Flagstar separately)
- Final approval hearing: October 1, 2026, in the Eastern District of Michigan
Why You Need to Know This — The Hidden Danger
Here’s what 30 years of helping people with debt has taught me: most folks think a data breach means a few weeks of junk mail and phishing texts, then it’s over.
With bank data, that’s exactly the wrong assumption. The real danger isn’t the money currently in your account — your bank has fraud protections for that. The danger is that thieves now hold the precise combination of information they need to impersonate you and open brand-new credit accounts: a credit card, a car loan, even a mortgage, all in your name.
That damage doesn’t show up next week. It shows up six months or a year later as a collection account on your credit report — for a debt you never took out, from a lender you’ve never heard of. By then the trail is cold and you’re stuck proving a negative: that you didn’t do something.
This is the part most data breach coverage misses entirely. Filing the claim gets you a check. Freezing your credit is what actually protects you.
Things to Consider
The $60 cash payment is nice, but it’s not the reason to act. The reason to act is the free three years of credit monitoring and — more importantly — the wake-up call to lock down your credit before someone uses your stolen data.
A few things worth thinking through:
- A credit freeze is free and reversible. It’s not the same as a fraud alert. A freeze actually blocks new accounts from being opened in your name until you lift it — which you can do anytime, for free, in minutes.
- You’ll need to freeze all three bureaus separately. Equifax, Experian, and TransUnion are three different companies. Freezing one does nothing for the other two.
- The settlement’s credit monitoring is a backstop, not a shield. Monitoring tells you after something bad happens. A freeze prevents it from happening in the first place. Use both.
What to Think About Doing
- Search your email and physical mail for a Flagstar settlement notice. Look for the Settlement Claim ID — you’ll need it to file the fast way.
- File your claim at the official settlement website before August 11, 2026. Take the cash payment if you don’t have documented losses; submit documentation if you do.
- Freeze your credit at all three bureaus — Equifax, Experian, and TransUnion. It’s free and takes about 10 minutes total.
- Pull your free credit reports at AnnualCreditReport.com and look for any account you don’t recognize. If something’s there that isn’t yours, that’s identity theft in progress.
- If you find a fraudulent account, report it at IdentityTheft.gov — the FTC’s official recovery site walks you through disputing it.
If accounts have already been opened in your name, you’re past prevention and into cleanup — and here’s exactly what to do when collectors start calling about debt that isn’t yours. There’s also a recent court ruling letting people sue over credit files allegedly sold to fake debt collectors — worth knowing your rights are expanding here.
This is what I’m seeing after watching data breaches play out for decades. Take it as one informed perspective — but only you know your full situation. The settlement deadline is real and the credit freeze is free, so there’s little downside to acting. Use this as input for your decision, not a directive. Nobody gets to tell you what to do with your money — including me.
One more thing: if you bank with anyone — and especially if you know someone who banked with Flagstar — send them this. Most people will never open that settlement envelope, and they’ll never freeze their credit. The five minutes it takes could save them a year of cleanup down the road.
Dealing With Debt? Understanding your options is the first step. See how all your debt relief options compare — including ones most sites won’t tell you about. The Find Your Path quiz gives a recommendation based on your actual numbers, and the Scam-O-Meter checks any company’s complaint history before you sign. Federal Reserve research shows bankruptcy filers recover faster than those who don’t file.
