OneMain Financial discloses data breach affecting thousands across multiple states

OneMain Financial Group, a consumer lending company based in Evansville, Indiana, disclosed a data breach first identified in May 2026 that exposed Social Security numbers and other personal information for more than 17,000 customers across several states.

The company said it acted to stop the unauthorized activity after discovering it, took steps to enhance its security measures, and began working with a cybersecurity and forensic firm to investigate. The investigation found evidence that data containing personal information was accessed or acquired on May 5, 2026. OneMain has not disclosed the specific type of cyberattack or identified the party responsible.

The exposed information included names, addresses, Social Security numbers and other account-related information. State filings show the breach affected at least 15,472 Texas residents, 1,516 South Carolina residents and 960 Oregon residents; it was also reported to California’s attorney general. Public disclosure to state authorities began Sept. 25, 2026, and OneMain began mailing notification letters to affected individuals on Sept. 28.

OneMain is offering affected consumers 24 months of complimentary credit monitoring and identity protection services through TransUnion. Enrollment is available through TransUnion’s website using an activation code included in the notification letter, with a deadline of Dec. 31, 2026. The company set up a dedicated phone line for breach-related questions, available Monday through Friday from 8 a.m. to 8 p.m. Eastern time, in addition to its general customer service line.

OneMain Financial operates more than 1,400 branches across 44 states, offering personal loans, auto loans and related credit products.

Shamis & Gentile and Murphy Law Firm, two law firms specializing in data breach cases, said they are investigating the OneMain breach. Murphy Law Firm has alleged that cybercriminals infiltrated an inadequately secured OneMain network, an allegation OneMain’s own disclosure does not address.