close
close
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Enforcement · Class-action lawsuit

Flagstar Bank reaches $31.5M settlement over 2021 data breaches affecting 2.2M people

Federal

Flagstar Bank agreed to pay $31.5 million to settle class-action claims stemming from two 2021 data breaches, linked to vulnerabilities in Accellion's file-transfer software, that together exposed personal information belonging to roughly 2.2 million customers. In one of the incidents, Flagstar paid hackers a $1 million ransom in an attempt to get stolen data deleted.

Why it matters A bank paid hackers a ransom to delete stolen data, then still had to pay $31.5 million to the customers whose data was stolen in the first place.
Read the primary source
Bloomberg Law
Open source

Published by Editorial on Sep 23, 2026. Not independently re-checked against the primary source — read it via the link above.

Related actions

Settlement / consent order Pending

DOJ’s $400M TikTok privacy settlement hits a snag: a judge may reject part of it

TikTok Inc. and ByteDance Ltd.

COPPA Federal

$400,000,000Pending

A $400M privacy settlement isn't final just because the government announced it: a judge can still send both sides back to the table.

Primary source
Regulator enforcement

FTC orders Illuminate Education to fix security after breach exposed 10.1M students’ data

Illuminate Education, Inc.

FTC Act Section 5 Federal

DecidedNo monetary penalty

There was no fine, but a company that ignores a two-year-old security warning can still be forced into a binding security overhaul.

Primary source
Regulator enforcement

FTC orders Match and OkCupid to stop misrepresenting how they share user data

Match Group, LLC and OkCupid

FTC Act Section 5 Federal

DecidedNo monetary penalty

There's no fine, but a privacy policy promise about who sees your data is now something the FTC will hold the company to directly.

Primary source

Summaries are DataGrail’s wording, not statutory text; amounts and outcomes come from the linked primary source.

This summary is DataGrail's own plain-language account, written for privacy practitioners. It is not legal advice. For the authoritative text, follow the primary-source link above.