McLean Mortgage Data Breach Settlement

McLean Mortgage borrowers and former employees who were notified of the October 2024 breach may claim. Four things are worth getting straight before you file. First, the $4,000 headline is the cap on one narrow tier, not on the settlement. It applies only to extraordinary losses — money actually lost to identity theft or fraud, backed by a police report or a submitted insurance claim. Ordinary out-of-pocket expenses — the tier nearly everyone is really in — are capped at $1,000, and the up to $100 of lost time ($25/hour, four hours) comes out of that same $1,000 rather than sitting on top of it. Second, the credit monitoring genuinely stacks, but the two cash routes do not. The Settlement Agreement grants three years of CyEx Financial Shield Complete monitoring, with $1 million of fraud insurance, “in addition to a Cash Payment” — so “$45 plus three years of monitoring” is accurate. On the cash side you must pick one: the flat $45, no proof of any kind, OR the documented-loss route. The Claim Form prints the warning three times. And unlike many data-breach settlements, a documented claim that fails here is rejected outright — it is not swapped for the $45. Third, this is a small, closed class — about 30,453 people. It is McLean Mortgage Corporation, a residential mortgage lender founded in 2008 in Fairfax, Virginia — not McLean Hospital, and not lenders generally. The class covers current and former McLean customers and employees who were notified starting around June 11, 2025. Having a mortgage with some other lender that was breached does not qualify you. Fourth, the online form will not open without the LoginID and PIN from your mailed notice — a real gate even on the no-proof $45. The ways around it: ask Simpluris to resend them at info@McLeanDataSettlement.com or (833) 200-6767, or use the printable Claim Form, which asks for the Login ID only “if known.” One more trap: the Notice and FAQ say a mailed form must be postmarked by December 10, 2026, while the printed Claim Form says claims must be received by it — do not mail this one late. The good news is that this is a wholly claims-made settlement with no common fund, no aggregate cap and no pro rata clause, so the $45 cannot shrink no matter how many people file. Claims close December 10, 2026, the same day as the Final Approval Hearing; opting out or objecting closes a month earlier, on November 10, 2026.

Do I Qualify?

You may be eligible if:

• Your PII was potentially compromised in the Data Incident McLean experienced on or around October 17, 2024. That is the whole class definition the Court certified: “all living persons residing in the United States whose PII was potentially compromised in the Data Incident experienced by McLean on or around October 17, 2024, including all persons who were sent a notice letter regarding the Data Incident”
• In practice, McLean’s records say so. The court-authorized Notice tells recipients that if you received notice of the Settlement or of the Data Breach, “McLean’s records indicate that you are” a Class Member. McLean began notifying people on or about June 11, 2025, and the Settlement Agreement estimates the class at approximately 30,453 individuals. Unsure? Simpluris will check for free at info@McLeanDataSettlement.com or (833) 200-6767
• Customers AND employees count. The Settlement Agreement records that the incident potentially exposed the personal information of 30,453 individuals, “including current and former McLean customers and/or employees” — so former staff are class members too, not just borrowers
• It has to be THIS McLean. McLean Mortgage Corporation is a residential mortgage lender founded in 2008 in Fairfax, Virginia, ranked among the top lenders in the Washington, D.C. area in 2021. It is not McLean Hospital and not a generic reference to McLean, Virginia. A mortgage with a different lender that had its own breach does not qualify you here
• Any US state. The class is national on its face and no benefit varies by state, even though the case is in the Eastern District of Virginia and most class members will be D.C.-area borrowers and former McLean staff
• You do NOT need to have lost any money. The flat $45.00 Alternative Cash Payment requires no proof or explanation at all beyond proof of class membership, and the three years of credit monitoring requires none either
• You do NOT have to give up the credit monitoring to take cash. The Settlement Agreement grants three years of CyEx Financial Shield Complete “in addition to a Cash Payment,” and Section II of the Claim Form is the only benefit box with no exclusivity warning printed on it
• But you DO have to choose on the cash side. Sections III, IV and V (ordinary losses, extraordinary losses, lost time) are one route; Section VI (the flat $45) is the other. Each prints a warning not to claim it alongside the other
• You will need your LoginID and PIN to file online, or a printable Claim Form if you do not have them. The online form will not open without both. The paper form asks for the Login ID only “if known”
• You are not in an excluded group. Out are McLean’s officers and directors and entities it controls; its affiliates, legal representatives, attorneys, successors, heirs and assigns; the assigned judge, the judge’s family and staff; and anyone who validly opts out by November 10, 2026
• You submit one valid Claim Form — only one per person, online or paper — by December 10, 2026. The Notice and FAQ say a mailed form must be postmarked by that date; the printed Claim Form says claims must be RECEIVED by it. November 10, 2026 is the last day to opt out or object

There are two separate gates here and they are easy to confuse. Getting into the online form. The claim form at McLeanDataSettlement.com opens on a login screen asking for the LoginID and PIN printed on the Notice mailed to you, and it will not open without both. That makes this an ID-gated settlement even for the flat $45, which itself asks for no receipts at all — the Settlement Agreement puts it exactly that way: “other than proof of Class membership, no documentation is required” for the Alternative Cash Payment, and the LoginID and PIN are that proof. The gate is not absolute. The settlement website tells anyone who cannot locate their credentials to email info@McLeanDataSettlement.com with their full name and mailing address and ask for them, or call (833) 200-6767 toll-free. And the printable Claim Form asks for the “Login ID (if known)” — so a class member who was notified but has lost the code can download the form from the settlement website, complete and sign it, and mail it to McLean Data Breach Settlement, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799. Class membership is what decides your claim; a missing code is a paperwork problem, not a disqualification. Proving each benefit. This splits cleanly. The three years of CyEx Financial Shield Complete credit monitoring requires no documentation — just check Section II. The flat $45 Alternative Cash Payment requires no proof or explanation whatsoever. Only the documented-loss route needs records. What counts. The Settlement Agreement is blunt: “Documentation must be from a third-party source.” For ordinary losses that means receipts and bank statements; for extraordinary losses, a police report or a submitted insurance claim. Notes or papers you wrote yourself may be attached to explain or support other proof, but they are never enough on their own. Every claim is signed under penalty of perjury and may be checked by the administrator. The conditions most write-ups skip. An ordinary loss must be actual, documented and unreimbursed, directly caused by the Data Incident, incurred after it, and not already covered by another reimbursement category. An extraordinary loss must additionally arise out of actual fraud or identity theft using your Private Information, and you must show you tried to recover the money — “by using insurance you already have or requesting relief from your financial institution’s consumer fraud policies.” Losses must fall between October 17, 2024 and December 10, 2026. You cannot claim anything already reimbursed by another source, including compensation provided through any credit monitoring or identity theft protection product, or through a bank’s consumer fraud policies — which matters here, because McLean already gave victims 12 months of free IDX monitoring in 2025. Lost time has its own proof rule. Up to four hours at $25.00 an hour, $100.00 maximum, needs no receipts — only an attestation signed under penalty of perjury that you spent the time responding to issues raised by the Data Incident, reasonably describing how. But it is inside the $1,000 ordinary-loss cap, not on top of it. Which tier your proof puts you in. Documentation of actual identity theft or fraud reaches the extraordinary tier, up to $4,000. Documentation of ordinary out-of-pocket expenses reaches only the ordinary tier, up to $1,000. And here the downside of a failed documented claim is real. The Settlement Agreement provides that if you do not submit third-party documentation, or the administrator rejects the claim for any reason and you fail to cure it, “the claim will be rejected” — there is no automatic fallback to the $45, which several other data-breach settlements do provide. If your records are thin, the safer choice is Section VI.

What Happened?

McLean Mortgage Corporation is a residential mortgage lender founded in 2008 in Fairfax, Virginia. It was ranked among the top lenders in the Washington, D.C. area in 2021 with roughly $3.5 billion in mortgage volume. As part of that business it collected and maintained the personal information of its customers and employees.

On or around October 17, 2024, McLean became aware that unauthorized cybercriminals had gained access to its computer network and the highly sensitive personal information stored on it — the “Data Incident.” Its breach notice said it “first identified suspicious activity within its digital systems on or around October 17, 2024” and that the investigation revealed certain files may have been downloaded without authorization. McLean’s own website was taken offline after the attack.

In November 2024 the Black Basta ransomware group publicly claimed responsibility, listed McLean on its leak site and posted images of what it said were stolen files, according to contemporaneous cybersecurity reporting. McLean has not verified that claim, and it is not known whether a ransom was paid.

McLean reported that the incident potentially exposed the personal information of 30,453 individuals, including current and former McLean customers and/or employees. The data varied by person but included names, Social Security numbers, driver’s license numbers, financial account numbers, passport numbers and health insurance information. McLean began notifying people on or about June 11, 2025 and offered 12 months of free IDX credit monitoring with a September 11, 2025 enrollment deadline.

Several class actions followed in the Eastern District of Virginia and were consolidated for all purposes on October 9, 2025 as In re McLean Data Breach Litigation, No. 3:25-cv-00461-RCY. The Class Representatives are Jayaprakash Radhakrishnan, Micah Parks and Priscilla Millberry. The Court appointed David K. Lietz of Milberg PLLC and A. Brooke Murphy of Murphy Law Firm as Class Counsel.

McLean denies that it did anything wrong and the Court has not decided who is right. The parties settled to avoid the costs, risks, disruption and uncertainty of continued litigation. As part of the settlement McLean represents that since the incident it has implemented multi-factor authentication across all servers and VPN accounts, enhanced endpoint protection, hardened user and system controls and strengthened email and backup security, all at its own cost.

The settlement is administered on a wholly claims-made basis: there is no common fund, no aggregate cap on class payments and no pro rata reduction. McLean or its insurer funds each Approved Claim at the stated amount and pays notice and administration costs, attorneys’ fees and expenses of up to $250,000.00 and $2,500.00 Service Awards per Class Representative separately. Simpluris is the Settlement Administrator.

Plaintiffs moved for preliminary approval on July 9, 2026, Judge Roderick C. Young heard the motion on July 27, 2026, and on August 12, 2026 the Court granted preliminary approval (ECF No. 39). Under the Settlement Agreement the Claims Deadline falls 90 days after the Notice Date, which puts the Notice Date at September 11, 2026 and the claim deadline at December 10, 2026.

The Final Approval Hearing is set for December 10, 2026 at 11:00 a.m. Eastern Time in Room 6100 of the Spottswood W. Robinson III and Robert R. Merhige, Jr. Federal Courthouse, 701 East Broad Street, Richmond, Virginia, or by Zoom or another virtual platform at the Court’s discretion. The date and time may change without further notice. Benefits are distributed only if the Court grants final approval and after any appeals are resolved — no payment date has been announced.

How to File Your Claim

1. FILE ONLINE AT WWW.MCLEANDATASETTLEMENT.COM — click Submit a Claim. The online form opens on a login screen that asks for the LoginID and PIN printed on the Notice that was mailed to you, and it will not open without both. This gate applies even to the $45 payment, which itself needs no receipts: the Settlement Agreement says that “other than proof of Class membership, no documentation is required” for it, and the LoginID and PIN are that proof
2. NO LOGINID? TWO WAYS IN. The administrator will resend your credentials — email info@McLeanDataSettlement.com with your full name and mailing address, or call (833) 200-6767 toll-free. Or skip the login entirely: the printable Claim Form asks for the “Login ID (if known)”, so a class member who was notified but has lost the code can download the form from the settlement website, complete and sign it, and mail it in
3. WATCH THE PAPER DEADLINE — THE OFFICIAL DOCUMENTS DISAGREE. The court-authorized Notice and the website FAQ both say a mailed Claim Form must be POSTMARKED no later than December 10, 2026. The printable Claim Form itself says twice that “Claims must be received by December 10, 2026” and that paper forms must be mailed “so that they are received by the Claims Administrator no later than December 10, 2026.” Do not bet a claim on which reading an administrator applies — file online, or mail far enough ahead that the form arrives by December 10
4. CHECK THE CREDIT MONITORING BOX — IT STACKS AND IT COSTS YOU NOTHING. Section II of the Claim Form is the three years of CyEx Financial Shield Complete one-bureau monitoring with $1 million of financial fraud insurance. It is the only benefit section on the form with NO “do not claim this if you are claiming…” warning attached, because the Settlement Agreement grants it “in addition to a Cash Payment.” Every class member can take it alongside any cash option, including the $45
5. THEN PICK ONE CASH ROUTE, NOT BOTH. Sections III (ordinary losses), IV (extraordinary losses) and V (lost time) are one route
6. Section VI (the flat $45) is the other. All three of III, IV and V carry the printed warning “DO NOT CLAIM THIS BENEFIT IF YOU ARE CLAIMING PAYMENTS FROM SECTION VI”, and Section VI says the reverse
7. DOCUMENT IT WITH THIRD-PARTY RECORDS. The Settlement Agreement is explicit that “documentation must be from a third-party source” — receipts, bank statements, police reports, submitted insurance claims. Notes or papers you wrote yourself can support other proof but are never enough on their own. Losses must have occurred between October 17, 2024 and December 10, 2026, must not already have been reimbursed by anyone else, and for extraordinary losses you must show you tried to recover the money through insurance you already have or your bank’s consumer fraud policies
8. A FAILED DOCUMENTED CLAIM IS NOT SWAPPED FOR THE $45 HERE. Under the Settlement Agreement, if you do not submit third-party documentation, or the administrator rejects the claim for any reason and you fail to cure it, “the claim will be rejected.” Unlike some data-breach settlements there is no fallback to the flat payment, so if your paperwork is thin, consider taking the $45 instead
9. MAIL PAPER CLAIMS TO McLean Data Breach Settlement, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799. Requests for Exclusion go to P.O. Box 25226, Santa Ana, CA 92799-9958, ATTN: Exclusion Request, postmarked by November 10, 2026. Objections are filed with the Clerk of Court, U.S. District Court for the Eastern District of Virginia, Richmond Division, 701 East Broad Street, Richmond, VA 23219 by November 10, 2026, with a copy to the administrator ATTN: Objections
10. SUBMIT ONLY ONE CLAIM FORM PER PERSON, online or paper. Pick your payment method on the form — PayPal, Venmo, Zelle, virtual prepaid card or check — and give an email address you actually read, because the credit monitoring enrollment code is emailed, not mailed
11. QUESTIONS: the Settlement Administrator, Simpluris, at info@McLeanDataSettlement.com or (833) 200-6767 toll-free
12. Visit the official claim form: https://www.mcleandatasettlement.com/

How Much Will I Actually Get?

THE $4,000 IS NOT A CAP ON THE SETTLEMENT — IT IS THE CAP ON ONE NARROW TIER. Read this before anything else, because the headline figure is the one most coverage gets wrong. The documented-loss side has two separate ceilings, not one. EXTRAORDINARY LOSSES: up to $4,000.00, and only for money actually lost to identity theft or fraud. The Settlement Agreement requires the loss to be an actual, documented, unreimbursed expense “arising out of actual fraud and/or identity theft” using your Private Information, directly caused by the Data Incident, incurred after it, and supported by third-party documentation such as a police report or a submitted insurance claim — plus proof you tried to recover the money through existing insurance or your bank’s fraud policies. ORDINARY DOCUMENTED LOSSES AND EXPENSES: up to $1,000.00, which is the tier nearly everybody is actually in. This covers the ordinary post-breach housekeeping — bank fees, postage, copying, travel and notary costs tied to addressing misuse of your Social Security number or date of birth, credit repair service fees, and the cost of additional credit reports, credit monitoring or other identity theft insurance products. LOST TIME sits INSIDE that $1,000, not on top of it: up to four hours at $25.00 per hour, a $100.00 maximum, claimed with a statement signed under penalty of perjury describing how you spent the time. The Claim Form and the Settlement Agreement both say the combined ordinary-plus-lost-time total is capped at $1,000.00. So if your only costs were freezes, credit reports and postage, your ceiling is $1,000 — and the $100 of lost time comes out of that same $1,000. HOW THE BENEFITS COMBINE: the credit monitoring is genuinely cumulative, the cash options are strictly either-or. Every class member may claim three years of CyEx Financial Shield Complete one-bureau credit monitoring, with $1,000,000.00 in identity theft and fraud insurance, monitoring for fraud or identity theft, unauthorized financial transactions and personal information tied to high-risk transactions, and access to fraud resolution agents. The Settlement Agreement grants it “in addition to a Cash Payment,” the website and Claim Form both say all class members are eligible for monitoring AND one or more cash options, and Section II of the Claim Form is the only benefit box with no exclusivity warning printed on it. So “$45 PLUS three years of monitoring” is accurate — the monitoring does not cost you the cash and the cash does not cost you the monitoring. WHERE YOU MUST CHOOSE: the flat payment versus the documented route. The Alternative Cash Payment is a one-time $45.00 “instead of any other payments,” with no proof or explanation required. The Claim Form prints the warning three times — Sections III, IV and V each say “DO NOT CLAIM THIS BENEFIT IF YOU ARE CLAIMING PAYMENTS FROM SECTION VI”, and Section VI says do not claim it if you are claiming from III, IV or V. WHAT THE TWO DOCUMENTED TIERS ADD UP TO. They are defined as separate categories and the Settlement Agreement bars double-counting rather than combining them, so a class member with both a documented identity-theft loss and documented ordinary expenses is working toward $4,000 and $1,000 on separate tracks — $5,000 in total. Nothing in the Settlement Agreement states a combined ceiling, and in practice the number of class members who can document actual fraud is small. THE $45 CANNOT SHRINK — THIS IS NOT A FUND. The Settlement Agreement says the Settlement “shall be administered on a wholly claims-made basis” and that the amount paid for Approved Claims “will be determined on a ‘claims made’ basis such that only those individual Approved Claims will be funded up to the maximum amount.” There is no common fund, no aggregate cap on class payments and no pro rata reduction clause anywhere in the agreement. A heavy claim rate does not cut your $45. McLean or its insurer pays each approved claim at the stated amount. THE LAWYERS ARE PAID SEPARATELY. Class Counsel will ask the Court to approve attorneys’ fees and expenses not to exceed $250,000.00, and Service Awards of $2,500.00 for each of the three Class Representatives — Jayaprakash Radhakrishnan, Micah Parks and Priscilla Millberry. McLean pays those, and the notice and administration costs, on top of class benefits rather than out of them. All of it is subject to court approval at the Final Approval Hearing. WHAT IS NOT PAID. Expenses already reimbursed by another source cannot be claimed — including anything already covered by a credit monitoring or identity theft protection product, or by a financial institution’s consumer fraud policies. Note that McLean already offered victims 12 months of free IDX credit monitoring back in 2025, with a September 11, 2025 enrollment deadline; the three years of CyEx monitoring in this settlement is separate and new. TIMING AND A FORFEITURE TRAP. Nothing is paid until the Court grants final approval at the December 10, 2026 hearing and any appeals are resolved — no payment date has been announced. The Settlement Agreement then gives the administrator up to 75 days after the Claims Finalization Date to send payments and to email credit monitoring activation codes; the activation window stays open 180 days and the three-year monitoring term runs from the date you enroll. A payment not cashed within 90 days of issuance becomes null and void, you forfeit it, and the money reverts to McLean or its insurer. You may request ONE re-issuance inside that 90-day window, and a re-issued payment must be negotiated within 30 days. The parties intend every payment to be cashed or voided within 120 days of the first payment date. There is no cy pres recipient — unclaimed money goes back to McLean, not to charity.

Last reviewed: October 2, 2026 | Information verified from court records and official settlement documents.

Frequently Asked Questions