FinWise Bank settles data breach lawsuit for $2.8 million

Utah-based FinWise Bank has reached a settlement in a class-action lawsuit arising from a 2024 data breach that compromised the personal information of nearly 690,000 individuals.

In September 2025, FinWise revealed that it had experienced a cybersecurity incident in which threat actors obtained unauthorised access to its internal network on May 31, 2024, and exfiltrated sensitive data. The subsequent investigation found that the incident impacted nearly 690,000 individuals, with exposed information including names, contact details, dates of birth, Social Security numbers, and more.

Following the cyber attack, a class-action lawsuit was filed against FinWise, FinWise Bancorp, and American First Finance in the U.S. District Court for the District of Utah. The complaint alleges that the healthcare provider failed to implement sufficient data security safeguards and adequately protect the personal information it held.

While FinWise denied any wrongdoing or negligence, the parties agreed to settle the lawsuit to avoid the costs and uncertainties associated with continued litigation and to provide Class members with compensation and other benefits outlined in the settlement agreement.

Under the proposed settlement, FinWise will establish a $2.80 million settlement fund to compensate eligible class members and cover credit monitoring, documented losses, attorneys’ fees, administration costs, and service awards.

Eligible class members may claim a pro rata cash payment and reimbursement of up to $5,000 for documented out-of-pocket losses reasonably linked to the Data Incident, including identity theft or fraud, credit monitoring, credit report fees, and certain miscellaneous expenses. Claims must include supporting documentation; self-prepared documents alone are insufficient, and expenses reimbursed by another source are not eligible.

The proposed settlement has been granted preliminary approval by the court but has not yet become final. A final approval hearing is scheduled for December 10, when the court will decide whether to approve the settlement.