Inside Bayview’s $26M breach deal: Fees, payouts

A federal judge has closed Bayview Asset Management’s massive data breach lawsuit, including OKing a big award for the plaintiffs’ attorneys. 

Processing Content

U.S. District Judge Darrin P. Gayles issued a final judgement in the case last Friday, ending a saga that began with a hack at Bayview’s servicing subsidiaries in late 2021. Bayview agreed to a $26 million settlement with 5,774,688 class members, one of the largest data breach deals in the mortgage space in recent years. 

The company will also pay a group of plaintiffs’ attorneys an $8.6 million award, and an additional $1.7 million in litigation expenses, both out of the settlement fund. Judge Gayles granted approval of that award last week, as plaintiffs’ attorneys in filings emphasized their workload worthy of the usual one-third of the settlement amount. 

In reaching the agreement, Bayview denied liability for the incident. A company spokesperson declined to comment Monday. 

Plaintiffs’ attorneys, including counsel from Morgan & Morgan who helmed the plaintiffs’ executive committee, didn’t respond to requests for comment Monday. 

How the settlement is being distributed

The yearslong class action case was filed in 2022, after Lakeview Loan Servicing reported that an unauthorized actor, who was never identified, was in its systems uninterrupted for 41 days. The breach was subsequently revealed to have affected millions of customers at Lakeview, Community Loan Servicing and Pingora Loan Servicing.

Over the past four years, the sides undertook 33 depositions and reviewed over 564,063 pages of documents, according to case filings. The $26 million settlement, agreed to last November, is an “outstanding result”, plaintiffs’ attorneys wrote to the court. 

The deal includes: 

• Service awards of $7,500 for named class representatives;
• Up to $5 million in aggregate reimbursements for documented out-of-pocket losses up to $5,000 per person;
• 2 forms of pro rata cash payments for class members, including one for California-based members;
• 1 year of complimentary identity theft credit monitoring services, valued at $32.95 per month. 

As of late May, just over 550,000 members had submitted claims for settlement funds, a rate of 9.5%, which the plaintiffs described as high. 
Plaintiffs’ attorneys, in a May motion to approve their award, said they devoted over $16.4 million worth of attorney time through March 2026 litigating the case. Judge Gayles wrote in an order that the attorneys’ award and separate expenses were fair and reasonable.

Unrelated to the civil class action, Bayview last year also paid a $20 million penalty to state regulators over its handling of the breach. 

Data breach settlements continue

The Bayview deal eclipses Loandepot’s $25 million data breach settlement in 2024 as the largest by a nonbank mortgage lender in recent years.

More industry players in the past few months have reached deals to settle consumer complaints over data breaches. SitusAMC in June quickly reached a $5.3 million agreement to cover over 600,000 class members affected in an incident last fall. Lenders AnnieMac and McLean Mortgage also announced this past spring reaching settlements with consumers over past incidents, with details scheduled to be filed soon.