A Michigan federal judge has granted preliminary approval to a $31.5 million settlement resolving consolidated class action claims that Flagstar Bank failed to adequately protect personal information during two major data breaches that exposed sensitive data of more than 2 million people.

U.S. District Judge Matthew F. Leitman signed off on the motion Friday during a remote hearing, directing counsel to submit a proposed order reflecting all relief components. The settlement, if finally approved, would provide nationwide relief to approximately 2.1 million class members affected by the 2021 and 2022 incidents.

The litigation stems from Flagstar's use of Accellion Inc.'s file transfer platform, which cybercriminals exploited in early 2021, compromising personally identifiable information of nearly 1.5 million individuals. A second breach in 2022 hit the bank's internal network, affecting another ~1.5 million people (with some overlap).

Plaintiffs alleged Flagstar knew of serious security vulnerabilities in the Accellion system yet continued relying on it, leading to unauthorized access to names, Social Security numbers, driver's license numbers, financial account details, and other sensitive data.

Under the proposed deal:

• Reimbursement for documented out-of-pocket losses up to $25,000 per person.
• Three years of credit monitoring and identity theft protection services.
• Up to $100 statutory payments for the ~364,000 California subclass members.
• Residual cash payments up to $599 if funds remain after claims.
• Any leftover money extends credit monitoring duration.

Judge Leitman acknowledged the case's contentious nature, stating, "I understood how hotly contested this was, and I appreciate the substantial efforts to settle this case."

Class counsel described the outcome as fair after years of litigation. Jordan A. Kane of Stueve Siegel Hanson LLP noted during the hearing: "We can all agree this is a fair result, and it comes after many years of litigation."

Flagstar's counsel, William E. Ridgway of Skadden Arps Slate & Meagher & Flom, called the settlement "hard fought."

Plaintiffs plan to request approximately $10.5 million in attorney fees plus $2,500 service awards for class representatives.

The case highlights ongoing risks in financial institutions' third-party vendor security practices and the growing wave of data breach class actions seeking substantial consumer relief for compromised personal information.