OneMain Financial Faces Class Action Over Alleged Data Breach and Security Failures
A class action lawsuit filed on September 28, 2026, in the U.S. District Court for the District of Maryland accuses OneMain Financial Group LLC of failing to protect customer data, leading to a breach that exposed sensitive personal information. The complaint, brought by plaintiff Randy Harris, alleges that OneMain’s inadequate security measures allowed an unauthorized party to steal customers’ names, addresses, Social Security numbers, and other account details.
The breach came to light on September 25, 2026, when OneMain disclosed the incident in a filing with the Texas attorney general. According to the lawsuit, the company’s security lapses including unencrypted data storage, prolonged retention of sensitive information, and a lack of industry-standard safeguards like intrusion detection and penetration testing enabled the attack. The stolen data later appeared on the dark web, where criminals trade personal information. The lawsuit further claims OneMain delayed notifying affected customers, leaving them vulnerable to identity theft.
Harris, a OneMain customer, alleges the breach has caused significant harm, including hours spent monitoring his accounts, credit reports, and passwords, as well as ongoing anxiety over potential identity theft. He seeks damages for negligence, breach of implied contract, and unjust enrichment, arguing that customers paid for security protections the company failed to provide.
The lawsuit proposes a nationwide class of all U.S. individuals whose data was accessed in the breach. It demands financial compensation, restitution, and court-ordered security improvements, including mandatory audits and lifetime credit monitoring for affected customers. As of now, no settlement or claims process has been established.
OneMain Financial Group LLC TPRM report: https://www.rankiteo.com/company/onemain
"id": "one1790973305",
"linkid": "onemain",
"type": "Breach",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Nationwide class of all U.S. '
'individuals whose data was '
'accessed in the breach',
'industry': 'Consumer Lending',
'location': 'United States',
'name': 'OneMain Financial Group LLC',
'type': 'Financial Services'}],
'attack_vector': 'Unauthorized access due to inadequate security measures',
'customer_advisories': 'Delayed notification to affected customers',
'data_breach': {'data_encryption': 'No (unencrypted data storage)',
'data_exfiltration': 'Yes (data appeared on the dark web)',
'personally_identifiable_information': 'Names, addresses, '
'Social Security '
'numbers',
'sensitivity_of_data': 'High (Social Security numbers, names, '
'addresses)',
'type_of_data_compromised': 'Personally identifiable '
'information, account details'},
'date_publicly_disclosed': '2026-09-25',
'description': 'A class action lawsuit accuses OneMain Financial Group LLC of '
'failing to protect customer data, leading to a breach that '
'exposed sensitive personal information, including names, '
'addresses, Social Security numbers, and account details. The '
'breach was disclosed on September 25, 2026, and the stolen '
'data later appeared on the dark web.',
'impact': {'brand_reputation_impact': 'Alleged failure to provide promised '
'security protections',
'customer_complaints': 'Significant harm including hours spent '
'monitoring accounts, credit reports, and '
'passwords; ongoing anxiety over potential '
'identity theft',
'data_compromised': 'Names, addresses, Social Security numbers, '
'account details',
'identity_theft_risk': 'High',
'legal_liabilities': 'Class action lawsuit filed for negligence, '
'breach of implied contract, and unjust '
'enrichment'},
'initial_access_broker': {'data_sold_on_dark_web': 'Yes'},
'investigation_status': 'Ongoing (lawsuit filed, no settlement or claims '
'process established)',
'motivation': 'Data theft for sale on the dark web',
'post_incident_analysis': {'corrective_actions': 'Mandatory security audits, '
'lifetime credit monitoring '
'for affected customers, '
'court-ordered security '
'improvements',
'root_causes': 'Inadequate security measures '
'including unencrypted data '
'storage, lack of intrusion '
'detection, lack of penetration '
'testing, prolonged retention of '
'sensitive information'},
'recommendations': 'Mandatory security audits, lifetime credit monitoring for '
'affected customers, court-ordered security improvements',
'references': [{'source': 'Class action lawsuit filing'}],
'regulatory_compliance': {'legal_actions': 'Class action lawsuit filed in '
'U.S. District Court for the '
'District of Maryland',
'regulatory_notifications': 'Disclosed to Texas '
'attorney general'},
'response': {'communication_strategy': 'Delayed notification to affected '
'customers'},
'title': 'OneMain Financial Data Breach and Security Failures',
'type': 'Data Breach',
'vulnerability_exploited': 'Unencrypted data storage, lack of intrusion '
'detection, lack of penetration testing, prolonged '
'retention of sensitive information'}