A proposed class-action lawsuit names both Redfin and its parent company, Rocket Companies, over claims that a data breach left the personal details of current and former staff members exposed. The lawsuit, brought by Frankie Moreno, who previously worked at Redfin, contends that a gap in the company's data security exposed her and others to fraudulent activity, monetary losses, and the prospect of ongoing harm.
The federal lawsuit filed by Moreno was submitted to the U.S. District Court for the Western District of Washington. Kaleigh Boyd, the attorney on the case, indicated that speaking publicly was outside the scope of what she had been authorised to do.
Redfin, headquartered in Seattle, operates as a wholly owned unit within the Rocket Companies portfolio. Detroit-headquartered Rocket Companies, whose operations span financial technology and homeownership services, completed its purchase of Redfin in the prior year. Rocket Limited Partnership, a separate subsidiary, holds responsibility for running four consumer-facing brands — Rocket Mortgage, Rocket Loans, Rocket Close, and Rocket Money.
Rocket directed inquirers to a prepared statement from Redfin, which described how unusual activity tied to a single employee account came to the company's attention in early March, prompting the engagement of forensic specialists to audit its infrastructure. Those specialists found no broader compromise, and individuals whose personal data may have been caught up in the incident were notified and offered two years of credit monitoring at no cost. The statement also noted that Redfin anticipates a favourable outcome in the pending litigation once the full factual record is placed before the court.
The lawsuit filed by Moreno pursues both class-action status and monetary compensation for those affected. Filed under the Washington Consumer Protection Act, the complaint contends that Redfin and Rocket left customer data exposed by failing to put adequate protective measures in place before the breach occurred. Legal representatives for Moreno attributed the data breach to the actions of outside criminal actors.
Personal details allegedly at risk in the breach — spanning names, Social Security numbers, driver's licence numbers, and financial account data — were outlined in court filings tied to the lawsuit. The lawsuit contends that personal data belonging to class members, left without encryption, has either already appeared on dark-web marketplaces or remains at risk of doing so. Court filings identify Moreno as a Texas-based individual who held a position at Redfin between September 2020 and November 2022.
According to the lawsuit, the data breach led to a notable uptick in unwanted email traffic reaching affected users. Attorneys for the plaintiff are seeking to define the class as workers employed in the United States by the firms whose confidential data was exposed — a group that, by their estimation, may run into the thousands.
Lawyers on the case contend that neither company provided details about when the intrusion took place, how long the intruder retained access, when the problem was detected, what allowed it to happen, or which data was affected. A formal disclosure about the episode was submitted by Redfin to the Massachusetts Office of Consumer Affairs and Business Regulation. Redfin's notification to affected individuals described a security event in vague terms, stating only that an unknown outside party may have gained access to personal data, with no additional explanation provided.
