Why more lenders are opting to make big payouts in data breach cases

• Key Insight: The real reason mortgage lenders are suddenly rushing to settle data breach lawsuits.
• What’s at Stake: Whether mortgage lenders can survive years of public litigation or must settle immediately.
• Supporting Data: $102 million: The total amount paid by mortgage originators, servicers, and vendors.

Lenders fending off the onslaught of lawsuits after a data breach can look to their peers who’ve increasingly paid big bucks to make the cases go away. 
Five real estate players spent over $9 million in settlements this summer to squash cybersecurity class action complaints. While those companies stemmed off potentially costly litigation, their timing could have in part been influenced by the slowing housing market.

Processing Content

“The tightening mortgage industry, and generally tightening economics, ultimately becomes a business decision of what’s the risk and value of settling versus litigating,” said Matt White, co-chair of Baker Donelson’s financial services cybersecurity and data privacy team. 

Since 2022, originators, servicers and vendors have paid over $102 million to silence consumer complaints over cyberattacks, according to a National Mortgage News review of industry data breach lawsuits. While the calculus continues to evolve for affected firms, as both litigation and dismissal opportunities arise, attorneys and settlements show that the cases will be an expensive ordeal for lenders. 

“The longer these things drag on, the more public they become,” said Matt White. “Then you have those reputational issues as well.” 

Why companies are settling faster

The five settling firms this summer — Academy Mortgage, AnnieMac Home Mortgage, NJ Lenders Corp., McLean Mortgage, and SitusAMC — all announced settlements in an eight-week span between June and August. SitusAMC OK’d the largest of those deals, a $5.3 million settlement to cover over 660,000 class members, just seven months after consumers began to file suit.

Erin Jane Illman, a partner at Bradley Arant Boult Cummings LLP, said both defendant companies and plaintiffs are making the decision to resolve complaints quicker.

“Courts have also been granting motions to dismiss, which creates early risks for plaintiffs to lose out on the settlement leverage,” said Illman. 

While the timelines from filings to settlements are speeding up, terms are also becoming more predictable, according to Settlement Insight Research. The tracking firm found no-documentation cash payments for class members falling between $50 and $100, and documented loss caps between $2,500 to $10,000, in line with many of the recent mortgage deals.

Why the cases are so expensive

Payouts hinge on the number of customers and type of data involved in a data breach. The involvement of personally identifiable information like Social Security numbers can hike up costs, while cases can be further complicated if the PII is posted to the dark web.

Settlements don’t include the money companies are required to invest in cybersecurity upgrades. Firms sometimes also suffer the added injury of paying cybercriminals a hefty ransom to secure their data. Of the 12 public settlement agreements among the over three dozen lenders sued for breaches in the past five years, all but two were larger than $1 million. 

Those deals can still be a bargain compared to litigation costs, which range from discovery, to electronic forensics, to the retention of expert witnesses. Attorneys’ awards, which are typically a third of the final settlement amount, also don’t include litigation expenses. 

In an outsized example of courtroom costs, plaintiffs’ attorneys in Bayview Asset Management’s four-year long data breach case received an $8.6 million award and $1.7 million for expenses out of a $26 million settlement.

Most mortgage companies may not consider themselves data brokers, but they hold a plethora of personal and financial information for a long period of time because of regulatory requirements, White explained. The dozens of data breach lawsuits in recent years are filed by either past borrowers or former employees. 

“Because of that, many of these lawsuits, at their inception, have a higher valuation than some of the other class actions we’ve seen, whether they be RESPA, or TCPA,” said White, referring to other frequently filed industry litigation.

Why do some companies avoid litigation?

A few companies which have disclosed data breaches have avoided litigation altogether. Others have secured dismissals, as Evolve Mortgage Services extinguished a brewing class action lawsuit earlier this year. 

Attorneys say dismissal odds may rise when there’s either a small number of affected individuals, no data published to the dark web, or no proof that PII was exfiltrated by a hacker during an incident. Plaintiffs could also face standing issues if the breach didn’t affect PII at all, or if they agreed to a mandatory arbitration provision with the company, said Illman. 

White also noted there’s rising case law in favor of mortgage lenders who ultimately choose to defend themselves from data breach claims. Some mortgage firms, including Mr. Cooper, continue to fight yearslong class action cases. 

“As we’re getting more and more decisions in courts around standing and injury and harm damages, I think we’re having more and more defenses that can be raised on behalf of a company,” he said.