On Oct. 14, a former employee filed a class-action lawsuit against the tech-based brokerage and listing platform Redfin—and its parent company Rocket—after a data breach this year.
The plaintiff, Frankie Moreno, worked for the company from around September 2020 to November 2022.
According to the 44-page complaint, Moreno alleges that the data breach compromised the personal information of current and former Redfin employees, and states that the plaintiff has “suffered fraud, financial and time losses, and the imminent, ongoing threat of further harm from the criminal misuse of their stolen private information.”
The lawsuit states that Redfin did not take the necessary steps to ensure the protection of users’ personal information, and as such were negligent in their security practices.
In response to the lawsuit, a Redfin spokesperson states that “in early March, Redfin identified suspicious activity involving a single employee account. Redfin promptly engaged forensic experts, and its systems were reviewed and confirmed secure.”
“Redfin also reviewed the relevant data, notified potentially affected individuals, and offered them two years of complimentary credit monitoring. The company is confident it will prevail in the related litigation once all the facts are presented.”
It wasn’t clear whether the data breach affected Redfin real estate agents—many of whom are W2 employees—as the Redfin spokesperson did not answer questions from RISMedia regarding how many individuals were affected.
The Redfin spokesperson noted that the breach occurred in March, the complaint does not mention when the breach took place—only that it was reported to the Massachusetts Office of Consumer Affairs and Business Regulation in late September.
Moreno, though, claims that Redfin failed to “timely and adequately notify plaintiff and class members about the data breach so they could take appropriate steps to mitigate the potential for identity theft and other damages.”
The lawsuit further accuses Redfin of negligence, breach of implied contract, unjust enrichment, invasion of privacy and in violation of the Washington Consumer Protection Act.
Allegations
The complaint states that Redfin learned that the private information of customers and/or employees within its network was accessed by an unauthorized third party, and subsequently reported the incident with the Massachusetts Office of Consumer Affairs and Business Regulation on Sept. 24.
It also claims that highly sensitive information such as names, Social Security numbers, financial account information and driver’s license numbers were entrusted to Redfin as necessary for employment.
Generally, it alleges that Redfin failed to implement and maintain reasonable and adequate data security measures to protect the private information of its customers and employees.
Moreno also points out in the filing that to date, Redfin “failed to disclose when the data breach occurred, how long the unauthorized actor had access to (Redfin) systems, when (Redfin) discovered the data breach, how the data breach occurred, or precisely what information was taken.”
The complaint emphasizes that Moreno no longer worked for Redfin at the time of the breach, and yet Redfin “continued to maintain her private information on their systems nearly four years later.”
This isn’t the first time a Rocket subsidiary was involved in a class-action lawsuit over a data breach. In October 2023, the mortgage mega-servicer Mr. Cooper—which was acquired by Rocket in 2025—disclosed that a portfolio of 4.3 million borrowers had suffered a data breach by malicious actors.
A lawsuit over that data breach is still ongoing.
Restitution
Because of the data breach, the complaint alleges that the plaintiff suffered actual injury from having her private information leaked. The specific injuries named range from spam calls and communication, to theft and invasion of privacy. Moreno also describes the time she lost to verifying the data breach and looking for signs of identity theft or fraud.
With the amount of spam Moreno received, the complaint suggests that her private information had been stolen and is “now in the hands of cybercriminals.”
The complaint states that the plaintiff seeks to recover actual damages sustained by each class member, together with the costs of the suit, including reasonable attorneys’ fees. She also requests that the court “increase the damages for each class member to three times the actual damages sustained,” but to not exceed $25,000 per class member.
Editor’s note: This story was updated at 4:05 p.m. Eastern Time with the complaint naming September as when the data breach was reported, but Redfin states the breach took place in March.
