OneMain Financial Faces Class Action Over Alleged Data Breach and Security Failures A class action lawsuit filed on September 28, 2026, in the U.S. District Court for the District of Maryland accuses OneMain Financial Group LLC of failing to protect customer data, leading to a breach that exposed sensitive personal information. The complaint, brought by plaintiff Randy Harris, alleges that OneMain’s inadequate security measures allowed an unauthorized party to steal customers’ names, addresses, Social Security numbers, and other account details. The breach came to light on September 25, 2026, when OneMain disclosed the incident in a filing with the Texas attorney general. According to the lawsuit, the company’s security lapses including unencrypted data storage, prolonged retention of sensitive information, and a lack of industry-standard safeguards like intrusion detection and penetration testing enabled the attack. The stolen data later appeared on the dark web, where criminals trade personal information. The lawsuit further claims OneMain delayed notifying affected customers, leaving them vulnerable to identity theft. Harris, a OneMain customer, alleges the breach has caused significant harm, including hours spent monitoring his accounts, credit reports, and passwords, as well as ongoing anxiety over potential identity theft. He seeks damages for negligence, breach of implied contract, and unjust enrichment, arguing that customers paid for security protections the company failed to provide. The lawsuit proposes a nationwide class of all U.S. individuals whose data was accessed in the breach. It demands financial compensation, restitution, and court-ordered security improvements, including mandatory audits and lifetime credit monitoring for affected customers. As of now, no settlement or claims process has been established.

On September 23, 2022, the California Office of the Attorney General reported a data breach involving OneMain Financial Group, LLC. The breach occurred on July 22 and August 8, 2022, due to a vendor error that resulted in credit card transaction reports being accidentally shared, potentially exposing cardholder names, credit card numbers, and Social Security numbers. The exact number of individuals affected is currently unknown.

On February 9, 2018, the New Hampshire Department of Justice reported a data breach involving OneMain Financial. Unauthorized access to personal or work email accounts used to access OneMain online accounts occurred between September 1, 2017, and January 16, 2018. The breach affected one New Hampshire resident. Compromised information may have included names, phone numbers, OneMain loan account numbers, and OneMain Rewards account details.