Academy's $2M data breach deal: Why litigating rarely beats settling

Academy Mortgage's decision to settle its data breach case for nearly $2 million adds to a growing body of evidence: lenders facing similar claims are choosing to pay rather than fight. As mortgage companies rack up millions in breach-related settlements this year, the calculus for in-house counsel and risk teams is becoming clearer, litigation is proving costlier, slower, and riskier than resolution.

The former lender, since acquired by Guild Mortgage, will pay $1,995,000 to cover a deal for approximately 285,000 class members, according to federal case filings this week. Those consumers, whose data was allegedly compromised in a 2023 cyberattack, are in line to claim pro rata payments. 

Plaintiffs filed an unopposed motion for preliminary approval of the class action settlement this week in a Utah federal court, to end two years of litigation over Academy's alleged negligence leading to the attack. Mortgage companies have coughed up millions of dollars so far this year as they have increasingly moved to settle the flurry of claims that follow persistent data breach incidents. 

The settlement follows the contours of many other agreements, including for Academy class members to receive 3 years of credit monitoring with identity theft insurance coverage for up to $1 million. Attorneys will also ask for a $665,000 award, equivalent to a third of the total sum, according to the filings. 

A judge has yet to weigh in on the deal. The resolution was announced two weeks after Academy agreed to pay $825,000 to a California regulator over its alleged lax cybersecurity measures contributing to the incident. 

Academy denied any wrongdoing in reaching the settlement. Neither a spokesperson for Guild nor attorneys for plaintiffs responded to requests for comment. 

What's in the settlement

The Academy deal allows for up to $3,000 reimbursements per class member for documented losses stemming from the incident. The six named plaintiffs are set to receive $2,500 class representative awards, while California residents can also receive a stepped-up payment, also to be determined. 

The agreement also requires the company to make certain business practice changes to enhance their data security. It didn't describe details of the March 2023 attack, which a ransomware gang then took credit for. 

The filings didn't mention Guild, or its parent company Bayview Asset Management. That servicing giant earlier this year agreed to its own $26 million data breach settlement for a class of over 5.7 million members, over a massive, unrelated incident in late 2021. 

More breaches and more deals

Few lenders are showing an appetite to litigate data breach claims, as four additional industry firms reached deals with plaintiffs this year. Some of those companies ended yearslong court battles, while SitusAMC wrapped up a class action case with a $5.3 million agreement seven months after it first revealed its hack. 

Consumers have sued seven more companies in the real estate and home finance spaces this year for negligence, in allegedly failing to protect their data in disclosed cyberattacks. Lennar and its financing arm are the latest defendants in a series of lawsuits after the homebuilder revealed this month two separate incidents affecting at least tens of thousands of customers.

The cyberattacks come with steep costs outside of the courtroom. The average cost of a data breach to companies reached $11.5 million in the past year, fueled in part by increasing artificial intelligence capabilities, according to IBM.