Flagstar Bank, N.A. Securities Lawsuit Investigation

Shamis & Gentile P.A., a law firm that advocates for investors who are victims of securities fraud, is investigating potential claims against Flagstar Bank, N.A. (FLG, FLG-PA)

If you have held Flagstar Bank securities since at least November 2021, you may be able to seek corporate reforms, the return of funds back to the Company, and a court approved incentive award for you, all at absolutely no cost.

About Flagstar Bank

Flagstar Bank is a federally chartered national banking association headquartered in Hicksville, New York.

The company’s business lines include regional consumer and commercial banking, as well as legacy mortgage origination, servicing, and warehouse lending. Its footprint expanded through the December 2022 acquisition of Flagstar Bancorp, Inc. and the March 2023 purchase of certain Signature Bank assets and deposits.

What's Being Investigated

The investigation focuses on allegations that Flagstar Bank and its predecessor entities may have failed to provide adequate board-level oversight of cybersecurity and disclosure controls following a late 2021 ransomware breach.

According to the SEC’s settled order from December 2024, the company described cyber risks as hypothetical in public filings even after management knew customer data had been stolen. The SEC found this conduct may implicate Sections 17(a)(2) of the Securities Act and Section 13(a) of the Exchange Act, along with related rules.

Allegations from investors and regulators center on:

• Delayed public notice of the breach and its scope
• Poor escalation of incident information to the board
• Weak governance and oversight of cyber risk and disclosure
• Repeated data security lapses that exposed the company to regulatory penalties and litigation

These issues reportedly led to significant costs, including a $31.5 million consumer settlement and a $3.55 million SEC penalty. Investors say that ongoing litigation and governance questions may affect the valuation and risk profile of both FLG common and FLG‑PA preferred shares.

Key Timeline

• November 22 to December 25, 2021: Ransomware threat actor accessed Flagstar’s Citrix environment, encrypting about 30% of systems and exfiltrating personal data of roughly 1.5 million individuals.
• March 1, 2022: Company filed its Form 10‑K, describing cyber risks as hypothetical despite internal knowledge of the breach and data theft.
• June 17, 2022: Flagstar posted a website notice about “unauthorized access,” which investors allege minimized the scope and impact of the breach.
• August 9, 2022: Q2 2022 Form 10‑Q filed, continuing to refer to “unauthorized access” rather than confirmed data exfiltration.
• December 16, 2024: SEC announced a $3.55 million penalty against Flagstar for disclosure failures related to the breach.
• October 2, 2025: Media reported Flagstar agreed to a $31.5 million settlement to resolve consumer claims involving over 2.2 million people affected by the 2021–2022 breaches.

Why Investors May Be Concerned

Investors and analysts allege that Flagstar’s board and senior officers may have failed to maintain adequate systems for monitoring and escalating cybersecurity risks, especially after learning of the ransomware attack and data theft in late 2021. The SEC’s order found that disclosure decision-makers received regular updates about the breach but lacked clear guidance on when and how to disclose material cyber incidents.

Stockholders argue this may represent oversight failure, where the board allegedly did not implement or monitor systems for mission-critical risks. Officer-level oversight failures are also alleged, with claims that key executives may have ignored red flags or failed to ensure accurate and timely disclosures.

These governance and control issues, combined with substantial regulatory penalties and settlement costs, may impact investor confidence, share price, and the perceived risk of holding FLG or FLG‑PA securities.

Your Rights and Next Steps

This is an active investigation into potential securities law violations and fiduciary breaches at Flagstar Bank. Investors who purchased or held FLG or FLG‑PA securities during the alleged misconduct period (November 2021 to August 2022) may have important rights.

Potential next steps may include:

• Requesting company records under New York Business Corporation Law §624 to investigate potential wrongdoing
• Pursuing shareholder actions under BCL §626 on behalf of the company to recover losses or seek governance reforms
• Seeking accountability measures such as stronger cybersecurity oversight, enhanced board-level risk monitoring, and improved disclosure controls for material incidents

If you believe you have relevant information or held FLG or FLG-PA shares and suffered losses, you may have the right to participate in the investigation and any resulting action.

What Shareholders Can do

Securities investigations are time-sensitive. If you purchased Flagstar Bank securities during the alleged misconduct period, and still hold some shares today, you may be eligible to join this investigation and seek corporate reforms, the return of funds back to the Company, and a court approved incentive award for you, all at absolutely no cost.

To protect your rights and ensure you are included in any potential recovery or governance reforms, complete the form below to join the investigation.