Flagstar Bank Data Breach Settlement: Claims Due Aug. 11

At a glance

Status

Closing soon

Defendant

Flagstar Bank, N.A.

Settlement fund

$31,500,000

Claim deadline

August 11, 2026

No-proof cash option

Yes — residual cash payment estimated at $60, capped at $599, no proof of loss required, or up to 25000

Max documented payout

$25,000

Administrator

Eisner Advisory Group LLC (d/b/a EisnerAmper)

Official site

flagstarsettlement.com

Court

U.S. District Court, Eastern District of Michigan

Case number

2:21-cv-10657-MFL-DRG (Angus et al. v. Flagstar Bank, N.A.), No. 2:21-cv-10657-MFL-DRG

Last verified July 16, 2026

Key dates

Milestone	Date	What it means
Claim deadline	August 11, 2026	Last day to file for a payment
Opt-out (exclusion) deadline	June 29, 2026(passed)	Last day to leave the settlement and keep the right to sue
Objection deadline	None listed	Last day to object to the terms
Final approval hearing	October 1, 2026	When the judge decides whether to approve the settlement
Expected payout	Not yet scheduled	Payments are not sent until after final approval and any appeals

Where to file

Flagstar Bank Data Breach Settlement (Angus v. Flagstar Bank) is administered by Eisner Advisory Group LLC (d/b/a EisnerAmper). The only place to file is the official settlement website:

File at the official site

flagstarsettlement.com

Filing is free. No legitimate settlement charges a fee to file a claim.

You cannot file on RecordingLaw.com. We are an independent publisher, not the settlement administrator, and we are not affiliated with any court, agency, or defendant.

Flagstar Bank customers and mortgage borrowers whose personal information was exposed in two 2021 data breaches now have a deadline to watch: August 11, 2026. That is when the claims window closes on a $31.5 million class action settlement covering roughly 2.19 million people. As of July 2026, the case is still moving through court, so here is what is confirmed, what a realistic payout looks like, and what to do if you are not sure whether you were affected.

What happened in the Flagstar Bank data breaches

The settlement resolves consolidated litigation over two separate incidents at Flagstar Bank, N.A., one in January 2021 and one in December 2021, that Flagstar disclosed had impacted customers' and employees' personal information. The case is known as Angus v. Flagstar Bank, N.A., filed in the U.S. District Court for the Eastern District of Michigan under case number 2:21-cv-10657-MFL-DRG.

Flagstar has not admitted wrongdoing. As with most bank data breach settlements, this one exists because litigating the underlying claims through trial would take years and cost more than either side expects to recover, so both parties agreed to a negotiated fund instead.

Where the case stands right now

As of July 2026, the settlement has preliminary court approval and is in its claims period. The deadline to submit a claim is August 11, 2026. The deadline to exclude yourself from the settlement, known as opting out, was June 29, 2026, and that date has already passed.

A federal judge still has to sign off on the deal at a final approval hearing scheduled for October 1, 2026, before any money moves. No payout date has been set, and none will be until after that hearing and any objections are resolved. If you came here looking for a check date, there is not one yet.

Who is in the settlement class

The class covers an estimated 2.19 million people in the United States whose personal information Flagstar identified as affected by the January 2021 and December 2021 breaches. Within that group, roughly 364,000 California residents make up a separate subclass with claims tied to California-specific privacy law.

If you banked with Flagstar, had a mortgage serviced by Flagstar, or worked there around 2021 and later received a breach notification letter or email, you may be part of this class. Membership is based on whether Flagstar's own records show your information was involved, not on whether you remember getting a letter.

How much money can you actually get

Two payment options exist, and most people will use the simpler one. If you do not want to document any loss, you can request a residual cash payment. The settlement administrator estimates that payment at around $60, with a hard cap of $599 per person, and no proof of loss is required for it.

If you had actual, documented losses connected to the breach, such as fraud charges, time spent resolving identity theft, or other measurable costs, you can instead claim reimbursement up to $25,000 with supporting records.

Eligible claimants can also enroll in three years of three-bureau credit monitoring at no cost, separate from either cash option.

Treat all of these numbers as estimates, not promises. They come out of a shared $31.5 million fund, and the actual per-person amount depends on how many people file valid claims and what the court approves for attorney fees and administrative costs. If claims run high, the no-proof payment could land well under the $60 estimate. Nobody is guaranteed a specific dollar figure.

What proof you need to file

For the no-proof residual payment, you do not need to submit documentation. You attest that your information was part of the breach and select that option.

For the documented-loss tier, you will need records tying your claimed loss to this breach, such as bank or credit card statements showing fraudulent charges, or receipts for costs you paid to address identity theft. The more specific and dated your documentation, the stronger your claim.

How filing works

The settlement offers two paths: the simpler no-proof residual payment, or the documented-loss claim with supporting records attached. Whichever path you choose, the deadline to submit is August 11, 2026.

A claims-made deadline like this one does not reopen once it passes. If you plan to file, do not wait until the last week, in case you need to track down records for the documented-loss option.

If you are not sure you were affected, or you missed a step

Whether or not you file a claim, the single most useful thing you can do after any bank data breach is freeze your credit at all three bureaus. It is free by federal law, takes a few minutes online, and blocks new accounts from being opened in your name, which is stronger protection than most paid monitoring services. See RecordingLaw's guide to freezing your credit after a data breach for the exact steps at Equifax, Experian, and TransUnion.

If you already had a freeze in place before filing a claim, you do not need to lift it to submit the claim form. If you notice suspicious activity on any account, report it at IdentityTheft.gov, which also builds a personal recovery plan.

The opt-out window for this settlement closed on June 29, 2026, so if you wanted to preserve your own right to sue Flagstar separately over these breaches, that option is gone. What remains is filing a claim, doing nothing, which still releases your claims but gets you no payment, or objecting to the terms before the court's October 1, 2026 hearing.

For other active recoveries like this one, RecordingLaw tracks open cases at its data breach settlement tracker.