2026 OneMain Financial — May network intrusion; ~16,988+ notified; names, addresses, SSNs
Data compromised
Names, addresses, Social Security numbers (per Murphy Law Firm / state-notification reporting); census cited across Texas and South Carolina filings (~16,988+)
Technical writeup
OneMain Financial Group, LLC reported becoming aware of suspicious activity on its computer network in May 2026. Subsequent forensic work determined cybercriminals infiltrated the network and accessed files containing sensitive personal information. Public reporting tied access/acquisition dates around May 5 and May 8, 2026, with California AG-facing disclosure around September 25, 2026 and consumer notification letters beginning about September 28, 2026. Aggregated state reporting cited by trade press covers at least ~16,988 people in Texas and South Carolina; names, addresses, and Social Security numbers are the attested data types. No named ransomware group claimed the incident in the sources used for indexing. companyConfirmed true.
Root cause
Unauthorized network access / cybercriminal infiltration of inadequately secured systems (forensic finding; May 2026 detection)