A shuttered lender has agreed to fund a data breach settlement with consumers for an incident which hit the company as it was winding down.

Instead of a lump sum, McLean Mortgage will pay affected individuals on a per-claim basis, according to case filings published this month in a Virginia federal court. The retail shop suffered a cyberattack in late 2024 that potentially exposed the personally identifiable information, such as Social Security numbers, of 30,453 customers and employees.

The lender was founded in 2007 and recorded nearly $3 billion in origination volume in 2022, according to Home Mortgage Disclosure Act records. That volume dwindled to just $93 million in 2023, and Nationwide Multistate Licensing System records show the company voluntarily surrendered its 14 state origination licenses, or let them expire, between 2023 and 2024. 

The company will give cash payments of $45 to settlement members who submit claims with no documentation required, according to the settlement filed with a motion for preliminary approval. Among other terms, claimants with documented losses can receive up to $4,000, and all are eligible for 3 years of complimentary credit monitoring services. 

Attorneys also asked the court to approve a fee and expense award of $250,000.

The filings did not describe the incident, other than saying the lender discovered unauthorized cybercriminals in its computer network on October 17, 2024. In reaching the deal, McLean denies the accusations of wrongdoing, and denies that the plaintiffs suffered any damages. 

Neither attorneys for the plaintiffs nor McLean responded to requests for comment, including what the expected claim rate could be, as other data breach settlements have estimated.

Data breach litigation moving forward

Other hacked mortgage lenders have resolved class action complaints on per-claim bases, although larger data breaches have led to big numbers. Earlier this year, vendor SitusAMC quickly agreed to a $5.3 million settlement for an incident affecting 662,000 individuals, while servicer parent Bayview Asset Management finalized a long-awaited $26 million deal for a class of around 5.8 million members.

AnnieMac also told a federal court this week that it will soon be filing a motion for preliminary approval of its settlement with plaintiffs who sued it over a 2024 breach affecting 171,000 consumers. 

Since the beginning of the year, five other mortgage lenders have been hit with new class action complaints over reported cyber incidents, including bankrupt firm Impac Mortgage Holdings.