A lawsuit filed by a former Redfin employee alleges that a data breach at the Seattle-based real estate company and its Detroit-headquartered parent, Rocket Companies, left workers' Social Security numbers, driver's licence details, and financial account data exposed — with both organisations taking months to notify those affected.
Court documents show that Frankie Moreno, a former Redfin employee whose tenure with the company ran from September 2020 through November 2022 and who has since relocated to Texas, filed the proposed class-action complaint in the U.S. District Court for the Western District of Washington, as reported by a news outlet. In the lawsuit, Moreno contends that the security breach gave rise to fraudulent activity, monetary damages, and a continuing exposure to harm, with the filing requesting both class-action status and compensatory relief.
Redfin and Rocket are named in the lawsuit as having failed to put adequate data protection protocols in place, with the filing also citing alleged breaches of Washington's Consumer Protection Act.
The case is not isolated. Two additional lawsuits connected to the same dispute — among them Marshall v. Redfin Corp. — are also part of the Rolland litigation. Separate legal actions targeting Redfin Corp. over the same employee data exposure landed in the Washington federal court, court records show, adding to a cluster of consolidated filings directed at the incident from multiple fronts.
Account-level irregularities tied to a single staff member were flagged by Redfin during March 2026, according to a company spokesperson. Following the incident, Redfin brought in forensic specialists to examine its infrastructure, determined that no ongoing exposure remained, and then contacted those whose data may have been at risk — providing two years of free credit monitoring as part of that outreach. In a statement to media outlets, Redfin's communications team expressed the view that a full airing of the facts would result in the company's position being vindicated in court.
According to Moreno's legal team, the companies have yet to provide answers on a range of questions: when the breach took place, how long outside parties retained access, at what point it was detected, how entry was gained, and exactly what data was removed. According to the filing, the breach is attributed to outside threat actors, with personal details taken in the incident — including names, Social Security numbers, driver's licence numbers, and financial account information — potentially available for purchase through underground online marketplaces. The lawsuit additionally alleges that individuals whose personal information was exposed subsequently received unsolicited messages tied to that security incident.
The legal team representing Moreno has put forward a proposed class covering workers at American companies whose personal data was exposed in the breach, with attorneys estimating that membership in the group could run into the thousands. Moreno's attorney, Kaleigh Boyd, told the outlet she lacked authorisation to comment on the matter.
In September 2026, Redfin submitted a formal notice to the Massachusetts Office of Consumer Affairs and Business Regulation disclosing that an unidentified outside party may have gained access to customers' personal data — details that came via a news outlet's reporting. Documentation of Notice 2026-1615 — the formal regulatory filing — indicates that unauthorised access put the personal data of no fewer than 55 Massachusetts residents at risk, with the compromised records spanning Social Security numbers, driver's licence numbers, and financial account details. That same notice also set a deadline of December 23, 2026, by which anyone — whether still employed or previously on staff — who was caught up in the breach would need to enrol in two years of complimentary credit monitoring and identity protection services, administered through IDX as the designated third-party provider.
Spanning close to six months, the gap between Redfin's internal detection of unusual account activity in March 2026 and the regulatory filings that brought that information before the public in late September forms the period now at the centre of the legal dispute.
Under Washington's RCW 19.255.010, any company that suffers a breach exposing unencrypted personal data faces a 30-day window to alert both the people whose information was compromised and the state Attorney General's office — a deadline that can be extended only when law enforcement formally requests additional time, as outlined by the Washington State Office of the Insurance Commissioner. Under RCW 19.86.090, the Washington Consumer Protection Act opens a path for private litigants to pursue compensation by demonstrating unfair or deceptive business conduct — a route that carries mandatory attorney's fees, actual damages, and the possibility of treble damages up to $25,000 per violation, all of which the plaintiffs are invoking in their claims.
On July 1, 2025, an all-stock transaction worth $1.75 billion brought Redfin under the Rocket Companies umbrella, with each Redfin share converted into 0.7926 Rocket Class A shares — a rate representing a 63% premium over the pre-deal price — and Redfin's base of operations in Seattle left in place. Rocket's broader 2025 expansion extended beyond the Redfin transaction, encompassing a separate $14.2 billion deal to absorb mortgage servicer Mr. Cooper and pushing the combined total outlay to roughly $15.95 billion — a consolidation that brought approximately 10 million borrowers under one unified platform.
Rocket appointed Alessio Sanfilippo — whose career at Meta centred on data and analytics rather than residential property markets — to lead Redfin in August 2026, filling a vacancy that opened when Glenn Kelman stepped down in January of that year after roughly two decades directing the company. The executive transition took place while the company was still working through a security response, at a point when questions about data handling across its combined mortgage and real estate operations had yet to be resolved.
A nationwide class-action complaint lodged by homebuyer plaintiffs in the U.S. District Court for the Eastern District of Michigan in January 2026 alleged the companies had operated a pay-to-play referral arrangement in breach of the Real Estate Settlement Procedures Act. Cybersecurity class actions filed across federal courts in September 2026 pointed to real estate, financial services, and healthcare companies as defendants, with filings tied to incidents involving social engineering and the theft of employee login credentials, as reported by a news outlet.
