NPE / LoanDepot Mortgage Lender Data Breach Class Action

In January 2024, loanDepot — one of the largest non-bank mortgage lenders in the United States — suffered a devastating ransomware cyberattack that crippled its IT systems and exposed the personal and financial data of approximately 16.9 million customers. The compromised data included full names, addresses, Social Security numbers, dates of birth, financial account numbers, and mortgage loan information. Following the breach, loanDepot was forced to take its systems offline, causing widespread disruption to loan origination and payment processing for millions of customers. Multiple class action lawsuits were quickly filed and subsequently consolidated in the Central District of California.

Plaintiffs allege that loanDepot failed to implement adequate cybersecurity measures despite being a high-value target holding extraordinarily sensitive consumer financial data, and that the company was negligent in its data protection obligations under various state and federal laws. The complaint asserts claims of negligence, breach of implied contract, unjust enrichment, and violations of California's Consumer Privacy Act (CCPA) and other state data protection statutes. As of 2025, the consolidated litigation is in active discovery, with plaintiffs pursuing class certification. The case is being closely watched as one of the largest financial-sector data breaches in recent years.