Loandepot faces mounting litigation over data breach

A cyber attack that took down Loandepot's systems in early January has ushered in a wave of litigation accusing the lender and servicer of failing to protect the personal identifiable information of its past and current customers.

Another class action suit was filed on Tuesday in the state of California, bringing the total count of pending class action suits to two – for now. 

On Wednesday, two law firms, Pennsylvania-based Lynch Carpenter and Texas-based Emerson Firm, publicly solicited for customers impacted by the data breach to reach out, which will likely pave the way for additional class action lawsuits to be lodged against the lender.

The incident, which resulted in the Loandepot having to temporarily take down most of its systems, exposed the private information of 16.6 million current and former customers. As of Thursday, Loandepot fully restored its operations, a company spokesman said.

The class action brought by Jonathan Rosa, a Loandepot borrower, claims the company "[willfully failed] to prevent the data breach" by making claims that customer PII was safe when in reality it was not. Rosa's suit also accuses the mortgage company of not investing adequately in privacy and security protections.

Loandepot declined to comment.

The suit points to Loandepot's security policy, in which the lender claims it "takes steps to safeguard…personal and sensitive information through industry standard physical, electronic, and operational policies and practices."

"Despite all of these promises, on Jan. 8, 2024, Loandepot allowed the data breach to occur whereby the personal, confidential PII of Plaintiff and Class members were viewed, disclosed to, and acquired by unauthorized parties," Rosa's suit said,

Per the litigation, customers impacted by the breach will face risk of identity theft and fraud. 

Loandepot is not the only company in the financial services space to be inundated with lawsuits following a cyber attack recently. Mr. Cooper and Fidelity National Financial face similar accusations after each had a security breach that exposed customer data.

Historically, class action suits similar to those currently lodged against Loandepot, Mr. Cooper and Fidelity take a considerable amount of time to settle in court.

For example, a suit filed after a data breach hit Equifax in 2017 and exposed the PII of 147 million people, took six years to settle in court. The credit bureau ultimately agreed to pay $425 million to the class. 

Meanwhile, a $1.2 million class action suit filed against Citywide Home Loans to resolve claims surrounding a 2020 breach was settled in July 2023.