Flagstar Bank is informing 837,390 US clients that threat actors breached the third-party service provider Fiserv, exposing their personal information. According to the data breach notification given to the impacted clients, the event involved vulnerabilities found in MOVEit Transfer, a file transfer programme that our vendor uses to support services it offers to Flagstar and its connected institutions. The banking institution emphasised that the MOVEit bug did not affect any of Flagstar Bank's systems or its capacity to provide customers with services. Flagstar initiated an inquiry into the event to ascertain the extent of the security incident as soon as it was made aware of the data breach.

On December 27, 2023, the Maine Office of the Attorney General reported that Flagstar Bank, N.A., experienced a data breach involving its vendor, Fidelity Information Services, LLC (FIS), due to vulnerabilities in MOVEit Transfer. The breach occurred between May 27 and May 31, 2023, affecting 25,891 individuals, including 22 residents of Rhode Island, with personal information possibly compromised. Identity theft protection services through Kroll were offered for two years.

The Maine Office of the Attorney General reported a data breach involving Flagstar Bank on June 17, 2022. The breach occurred between December 3 and December 4, 2021, affected 1,547,169 individuals in total, and involved unauthorized access to personal information, including Social Security Numbers. Identity theft protection services were offered for two years through Kroll.

Flagstar Bank, a New York-based mortgage lender, faced severe financial and reputational repercussions due to two major data breaches in 2021 and 2022, which exposed the personal information of millions of customers. The fallout included a $31.5 million settlement in multiple class-action lawsuits filed by affected former customers, alongside an additional $3.5 million fine imposed by the SEC for misleading public statements regarding the breaches. The incidents not only led to substantial monetary losses but also eroded trust among customers and regulators. The breaches occurred before Flagstar sold its mortgage servicing business to Mr. Cooper in 2024, yet the legacy of the attacks continues to impact its standing in the financial sector. The exposed data likely included sensitive personal and financial details, amplifying the severity of the breach and its long-term consequences for both the company and its clients.

On March 15, 2021, the California Office of the Attorney General reported a data breach involving Flagstar Bank, which occurred on January 20, 2021. The breach was due to an exploited vulnerability in the Accellion file sharing platform, affecting an unspecified number of individuals' personal information.