On August 25, plaintiffs in a data breach class action filed a motion for preliminary approval of a $1.995 million class action settlement in the U.S. District Court for the District of Utah, which the defendant did not oppose. The litigation arose from a purported March 2023 data breach in which a mortgage company became aware that its network was accessed without authorization and, following investigation, determined that potentially compromising personally sensitive information — including names, Social Security numbers, and dates of birth — of approximately 285,000 individuals may have been compromised. Notice of the breach was sent to affected individuals beginning in December 2023, and multiple lawsuits filed in January 2024 were consolidated into the present action. The motion for preliminary approval seeks certification (for settlement only) of a class consisting of persons who received notices of the breach sent by the defendant. The operative complaint alleged claims for negligence, breach of implied contract, unjust enrichment, invasion of privacy, and violations of state consumer protection laws.

The proposed settlement would create a settlement fund of $1.995 million, from which class members may claim: (i) reimbursement for documented out-of-pocket losses up to $3,000; (ii) a pro rata cash payment from the settlement fund, to be determined from specified allocation criteria in the settlement; and (iii) three years of one-bureau credit monitoring with dark web monitoring, up to $1 million in identity theft insurance, and fully managed identity recovery services. California residents would receive a stepped-up pro rata payment to account for statutory damages claims. The settlement also requires the defendant to make certain business practices changes to enhance its data security going forward.