A class action lawsuit alleges OneMain failed to protect customer data, leading to a data breach.

On Sept. 28, 2026, Randy Harris filed a class action lawsuit against OneMain Financial Group LLC in the U.S. District Court for the District of Maryland.

The lawsuit alleges the lender's inadequate data security allowed an unauthorized party to steal customers' names, addresses and Social Security numbers in a data breach.

What happened in the OneMain data breach?

OneMain specializes in secured and unsecured personal installment loans for borrowers with below-average or fair-to-bad credit. Customers must disclose sensitive personal information to receive a loan, the complaint says.

An unauthorized party reportedly accessed and obtained files containing that information, which included names, addresses, Social Security numbers and other account-related information. On Sept. 25, 2026, the company filed a public notice about the breach with the Texas attorney general. Harris filed the lawsuit three days later.

The alleged security gaps

The lawsuit alleges OneMain did not encrypt the obtained information, held on to it for longer than necessary and did not implement industry-standard safeguards, such as intrusion detection, access controls and penetration testing.

Had the company properly monitored its networks, it would have identified the breach sooner, the filing contends. Following the breach, the stolen information allegedly surfaced on the dark web, where criminals buy and sell personal data. The lawsuit claims the company waited too long to notify affected customers, a delay that left them unable to protect themselves.

Harris' reported experience

As a OneMain customer, Harris says he had to give the lender his personal information. Researching the breach, reviewing his bank accounts, monitoring his credit report and changing his passwords have cost him several hours, the lawsuit alleges.

Harris claims he experienced fear, anxiety and stress following the breach and says he expects to keep spending time and money to guard against a heightened risk of identity theft for years to come.

The legal claims against OneMain

The lawsuit brings bring four claims, each on behalf of a nationwide class:


  • Negligence, which contends the company failed to use reasonable care to protect the information it collected

  • Negligence per se, which ties that duty to Section 5 of the Federal Trade Commission Act and its ban on unfair business practices

  • Breach of implied contract, which rests on an unwritten agreement that the lender would keep customer data secure and give prompt notice of any breach

  • Unjust enrichment, which describes customers paying prices that covered security protections they never received

Harris seeks actual and statutory damages, restitution and the profits OneMain gained from its alleged failures plus a court order requiring the company to strengthen its data security, audit its systems periodically and fund lifetime credit monitoring and identity theft insurance for class members.

What the lawsuit means for OneMain borrowers

The proposed class covers all individuals living in the United States whose private information an unauthorized party accessed or acquired in the OneMain Financial data breach.

As of this writing, there is no settlement, no claims process and no money available.