SoFi Lawsuit: Data Breach, Lending and Regulatory Claims

The Data-Breach Claim

SoFi, the online lender and financial-services app, faces a class action alleging it failed to adequately protect customer information in a data breach that exposed sensitive personal details — names, dates of birth, contact information, and employment and education data — for tens of thousands of people. As with other breach cases, the claim is that the company’s security was unreasonable and that affected customers face a heightened risk of identity theft.

For a company built on holding customers’ financial data, data-security expectations are high.

The Lending and Regulatory Claims

SoFi separately settled a class action alleging it discriminated by denying loans based on immigration status — treating DACA recipients and lawful permanent residents differently — which plaintiffs said violated civil-rights protections. On the regulatory side, SoFi’s brokerage unit drew FINRA fines over compliance failures, including customer-identification and identity-theft-prevention shortcomings, and the company has litigated the reach of its arbitration agreements.

These are distinct issues — data security, fair lending, brokerage compliance — reflecting how many regulatory fronts a modern fintech operates on.

What Customers Should Know

If you received a SoFi breach notice, consider a credit freeze and monitor your accounts, and keep the notice for any claim. On lending, fair-credit laws bar discrimination on protected grounds; if a denial seems tied to immigration status or another protected characteristic, that is worth documenting and questioning.