Academy Mortgage $1.995M Data Breach Class Action Settlement

Data Breach · Claims Not Open Yet

Current Status

Claims are not open yet. Judge David Barlow of the U.S. District Court for the District of Utah granted preliminary approval of the $1,995,000 settlement on September 29, 2026. Under the settlement agreement, the administrator has 30 days from that order, until October 29, 2026, to launch the settlement website and start mailing postcard notices. The claim deadline will be printed on the notice; no final approval hearing date or payment date had been announced as of October 1, 2026.

What Changed Recently?

Plaintiffs filed an unopposed motion for preliminary approval on August 25, 2026, after two full-day mediations ended more than two years of litigation over the breach. The court granted that motion on September 29, 2026, finding the settlement likely to be approved as fair, reasonable and adequate, preliminarily certifying the settlement class, approving the notice program and appointing Kroll Settlement Administration as administrator.

The case grew out of a data incident Academy Mortgage became aware of in March 2023. After concluding that names, Social Security numbers and birth dates may have been accessed, the Utah-based lender began notifying affected people in December 2023. Several lawsuits followed and were consolidated in 2024; in October 2025 the court dismissed some claims and allowed others to proceed. Academy Mortgage does not admit liability under the settlement.

Who Qualifies?

The settlement class is every living person residing in the United States who was notified by Academy Mortgage that their personal information may have been affected by the data incident. The court put the class at about 285,000 people.

Excluded are Academy Mortgage and entities it controls, its officers and directors, the judges assigned to the case and their staff, the attorneys for the parties, and anyone who opts out.

How Much Can You Get?

A class member can claim any or all of three benefits:

• Reimbursement of documented out-of-pocket losses up to $3,000 per person, for unreimbursed costs reasonably related to the data incident or to dealing with its effects.

• A pro rata cash payment, with no documentation required. California residents who submit a sworn attestation of California residency receive twice the standard amount, to account for their statutory damages claims.

• Three years of one-bureau credit monitoring with dark web monitoring, up to $1 million in identity theft insurance and identity recovery services.

The pro rata payment comes last. The $1,995,000 fund first pays administration costs, taxes, any service awards and any attorneys' fees and costs the court approves, then valid documented-loss claims; whatever remains is divided among valid pro rata claims, with each California claim counted twice. Class counsel will ask for one-third of the fund ($665,000) plus up to $50,000 in costs, and $2,500 service awards for each class representative, all subject to court approval. No per-person estimate has been published, and the final amount depends on how many people file.

What Proof or Notice ID Is Required?

The pro rata cash payment and the credit monitoring require no receipts or other documentation. The documented-loss reimbursement requires an attestation that the losses resulted from the data incident plus reasonable third-party documentation, such as receipts, statements or correspondence.

The court-approved postcard notice carries a Class Member ID. The online claim form has not been published yet, so whether it can be completed without that ID is not yet known; data breach claim portals usually require one. Keep the postcard when it arrives.