Post-M&A breach suit signals cyber due diligence risk

A recently acquired mortgage banker has agreed to settle a class action lawsuit over a data breach that occurred last August.

NJ Lenders Corp. will pay up to $100,000 in total to class members, which includes anyone who received direct notice from the lender that their private information may have been impacted in the incident. The breach potentially exposed the names and social security numbers of about 30,000 individuals, according to court documents. 

The settlement received preliminary approval from the court last month.

Class members who file a valid claim form may be eligible to collect up to $2,500 for out-of-pocket losses incurred between Aug. 18, 2025, and Oct. 1, 2026, due to the breach. This covers expenses that resulted from identity theft, credit monitoring, replacing IDs and more, the settlement said.

Class members can also file a claim form for a $40 flat cash payout with no proof necessary. All forms must be submitted by Oct. 1.

The amount of each class member's documented-loss or cash payout may be reduced proportionally if the total value of claims exceeds the $100,000 cap, according to the filing.

Additionally, all class members will receive a code to enroll in one year of CyEx Financial Shield Complete, which includes up to $1 million of identity theft insurance coverage and monitoring for fraud and identity theft, unauthorized financial transactions and more. Activation instructions will be shared once the class action settlement receives final approval from the court, the filing said. 

NJ Lenders agreed to implement internal remedial measures and security enhancements to better protect consumer data as well.

The court will decide whether to grant final approval following a hearing on Oct. 16.

Shortly after NJ Lenders notified those affected, multiple class actions were filed in the United States District Court for the District of New Jersey. Plaintiffs then filed a consolidated complaint on Jan. 2, claiming the lender failed to safeguard its computer systems from unauthorized access, leading to a cyberattack. The sides quickly worked toward a settlement to conserve resources. 

NJ Lenders was acquired by Luminate Bank for an undisclosed amount a few months before the breach occurred. The Minnesota-based bank brought about 200 employees, including 123 mortgage loan originators responsible for more than a billion dollars in origination volume in 2024.

Luminate Bank did not respond to a request for comment.

NJ Lenders is one of many mortgage lenders to settle a data breach lawsuit this summer. McLean Mortgage recently announced it will pay affected customers on a per-claim basis after it suffered a cyber attack in late 2024 that potentially exposed personal information of more than 30,000 customers and employees.