Original Coverage & Source Attribution: hoodline.com
A former Redfin employee has sued the Seattle-based real estate company and its Detroit parent, Rocket Companies, claiming a breach of internal computer systems exposed workers’ Social Security numbers, driver’s license numbers and financial account information — and that the companies sat on the news for months before telling anyone.
Frankie Moreno, who worked for Redfin from September 2020 to November 2022 and now lives in Texas, filed the proposed class-action suit in the U.S. District Court for the Western District of Washington, according to The Seattle Times. Moreno alleges the security lapse led to fraud, financial losses and an ongoing risk of harm, and is seeking class certification along with financial restitution. The suit accuses Redfin and Rocket of failing to take reasonable and adequate data security measures and of violating the Washington Consumer Protection Act.
Moreno’s case is not alone. At least two other related suits — Marshall v. Redfin Corp. and Rolland v. Redfin Corp. — were also filed in the same Washington federal court over the same employee data exposure, according to Westlaw Today, part of what the outlet describes as a broader wave of consolidated federal filings tied to the incident.
What Redfin Says Happened
According to a Redfin spokesperson cited by The Seattle Times, the company identified suspicious activity involving a single employee account in March 2026. Redfin says it engaged forensic experts, reviewed its systems and confirmed them secure, then notified potentially affected individuals and offered two years of complimentary credit monitoring. A Redfin spokesperson told the paper the company expects to prevail in the litigation once all the facts are presented.
But Moreno’s attorneys say the companies have not disclosed when the breach occurred, how long unauthorized access lasted, when it was actually discovered, how it happened, or precisely what information was taken, per The Seattle Times. The lawsuit attributes the breach itself to cybercriminals and alleges the exposed data — names, Social Security numbers, driver’s license numbers and financial account information — could be sold on the dark web. It also claims the breach triggered a dramatic increase in spam targeting affected individuals.
Moreno’s attorneys propose a class covering American employees whose private information was compromised and believe it could ultimately include thousands of people. Kaleigh Boyd, an attorney representing Moreno, declined to comment Friday, saying she was not authorized to do so, The Seattle Times reported.
Months Between Discovery and Disclosure
Redfin filed an incident notice with the Massachusetts Office of Consumer Affairs and Business Regulation in September 2026, stating that a security incident may have allowed an unauthorized third party to access personal information, per The Seattle Times. The formal filing, Notice 2026-1615, confirmed unauthorized access exposed personal information — including Social Security numbers, financial account details and driver’s license numbers — for at least 55 Massachusetts residents, according to Claim Depot. That notice also set a Dec. 23, 2026 deadline for affected current and former employees to enroll in the two years of complimentary credit and identity protection services offered through third-party vendor IDX.
The gap between Redfin’s March 2026 discovery of the suspicious account activity and its late-September public regulatory disclosures is central to the legal fight. Washington’s data breach notification statute, RCW 19.255.010, requires businesses that experience a breach of unencrypted sensitive personal information to notify affected residents and the state Attorney General within 30 days, unless law enforcement requests a delay, per the Washington State Office of the Insurance Commissioner. Plaintiffs are leaning on that standard as they press their Washington Consumer Protection Act claims, which under RCW 19.86.090 allow private plaintiffs who establish unfair or deceptive business practices to recover actual damages, mandatory attorney’s fees and discretionary treble damages capped at $25,000 per violation, according to WA.gov.
A Company in Transition Since the Rocket Merger
The breach lawsuit lands as Redfin undergoes significant change following its acquisition by Rocket Companies. Rocket Companies is a financial technology and homeownership services company based in Detroit, and it completed its $1.75 billion all-stock acquisition of Redfin on July 1, 2025, exchanging 0.7926 shares of Rocket Class A stock for each Redfin share — a 63% premium — while keeping Redfin’s Seattle headquarters intact, according to PropNewsTime. The Redfin deal was part of a larger $15.95 billion acquisition campaign by Rocket in 2025 that also included a $14.2 billion purchase of mortgage servicer Mr. Cooper, creating a combined platform serving roughly 10 million borrowers, per Scotsman Guide.
In August 2026, Rocket named Alessio Sanfilippo, a former Meta data and analytics executive with no residential real estate background, as Redfin’s new CEO, following the January 2026 departure of longtime chief executive Glenn Kelman, who had led the company for two decades, Executive Moves reported. The leadership change arrived in the middle of Redfin’s security response and amid continuing scrutiny of how the combined companies handle data across their mortgage and real estate operations.
Redfin and Rocket are also fighting a separate, unrelated legal battle. In January 2026, homebuyer plaintiffs filed a nationwide class-action suit in the U.S. District Court for the Eastern District of Michigan, accusing the companies of running an illegal pay-to-play referral scheme in violation of the Real Estate Settlement Procedures Act, per Scotsman Guide. Hoodline covered a related kickback suit against Rocket in March.
The data breach case also arrives amid a broader surge in cybersecurity litigation. Federal courts nationwide recorded a sharp spike in cybersecurity class actions targeting real estate, financial services and healthcare firms in September 2026, following social engineering attacks and employee credential compromises, according to Westlaw Today.
