Flagstar Bank $31.5M data breach settlement: See if you're eligible and learn what to do if your data is compromised 

Flagstar Bank, one of the largest regional banks in the U.S, has agreed to a $31.5 million settlement stemming from two data breaches back in 2021. But the deadline to claim your part of the payout is just days away.

In January 2021, hackers allegedly accessed the personal information of more than 1.4 million Flagstar customers. That incident was followed by another breach in December of the same year.

In a complaint, the plaintiffs alleged the Hicksville, New York-based financial institution failed to adequately protect its customers’ personal information and delayed providing notice about the two breaches.

Approximately 2.19 million people are included in the settlement class. Flagstar denied any wrongdoing but agreed to the settlement to avoid the prospect of prolonged litigation.

Eligible claimants may receive reimbursement for documented losses of up to $25,000 or a residual cash payment of about $60. The last chance to submit a claim is Tuesday, Aug. 11, 2026.

Here’s what you need to know about Flagstar’s $31.5 million data breach settlement, including who is eligible, how to file a claim and what to do if you’re the victim of identity theft.

If you’re not sure whether you are a class member, you can go to the settlement website or call 855-542-0397.

You can also contact the settlement administrator at:

Flagstar Settlement Administrator
P.O. Box 4427
Baton Rouge, LA
70821

To receive a payment from the settlement, you must submit a valid claim by Aug. 11, 2026. You can file a claim online or print a PDF claim form to complete and mail to the settlement administrator.

The deadline to object to or be excluded from the settlement was June 29, 2026.

With identity theft, quick action is critical. The longer someone has access to your financial accounts, the more damage they can do:

1. Place fraud alerts with Experian, Equifax and TransUnion.
2. Review your bank and credit card statements for suspicious activity.
3. Freeze your credit to prevent new accounts from being opened in your name.
4. Report any cases of identity theft to the Federal Trade Commission.
5. Keep records of all fraudulent transactions and communications with authorities.
6. Review your credit reports for signs of suspicious activity at least once every six months.

Your credit card company or bank may provide free updated credit score information and

While most strategies come into play after fraud occurs, there are a few proactive steps you can take to reduce your risk of identity theft. A password manager can help keep your passwords and usernames secure — two of our favorites, Keeper and Dashlane, add dark web monitoring and email masking for additional protection.

Even if you’re not the victim of an attack, freezing your credit reports prevents anyone from opening a new account in your name. There’s no damage to your existing accounts or credit score, and you can unfreeze your accounts whenever you want to apply for a new line of credit.

You’ll have to freeze your reports with each of the three credit agencies

Identity monitoring service Aura freezes your credit reports for you, and offers numerous other security features, including a password generator, VPN, email aliases, robocall filters and malware protection.

Why trust CNBC Select?

At CNBC Select, our mission is to provide our readers with high-quality service journalism and comprehensive consumer advice so they can make informed financial decisions. Every cybersecurity article is based on rigorous reporting by our team of expert writers and editors. While CNBC Select earns a commission from affiliate partners on many offers and links, we create all our content without input from our commercial team or any outside third parties, and we pride ourselves on our journalistic standards and ethics.

Catch up on CNBC Select’s in-depth coverage ofcredit cards,bankingandmoney, and follow us onTikTok,Facebook,InstagramandTwitterto stay up to date.