OneMain Financial data breach: 122,783 people, no customer accounts accessed

How many people were affected by the OneMain data breach?

122,783 in total, according to the number OneMain reported to Indiana. The letter gives no count.

Regulator	Who it counts	Number	Recorded
Indiana attorney general	Total reported by OneMain	122,783	Notice September 28, 2026
Texas attorney general	Texans	15,472	Posted September 25, 2026
Massachusetts consumer affairs office	Massachusetts residents	39	Reported September 25, 2026
Indiana attorney general	Indiana residents	4	Notice September 28, 2026

Texas's attorney general lists 15,472 Texans for OneMain, posted on September 25, 2026.

Massachusetts marks Social Security numbers and financial account numbers as breached for its residents. Indiana's list also carries an earlier, much smaller OneMain notice: 34 people, sent February 5, 2026, for a breach dated November 13, 2025. This page covers the May 2026 breach.

What happened at OneMain?

Date	Event
May 5, 2026	Breach date on Indiana's record
September 25, 2026	Notice recorded in Massachusetts
September 28, 2026	Notice recorded in Indiana
December 31, 2026	Deadline to enroll in TransUnion monitoring

The letter does not date the discovery or say how the activity began. It says OneMain stopped the activity, strengthened its security and worked with a leading cybersecurity and forensic firm. Notices came 146 days after Indiana's breach date.

What information was involved?

The letter names the reader's name and address, one further item and other account-related information. The filed copy cuts the further item short. Massachusetts records Social Security numbers and financial account numbers for its residents. OneMain says it had received no reports of fraud or identity theft tied to the incident.

Was my OneMain account hacked?

According to the letter, no. The investigation found no evidence of unauthorized access to customer accounts. The exposed data came from OneMain's systems, not from logins to individual accounts. Watch for phishing that uses your name, address and account details, and check statements for anything you do not recognize.

What is OneMain offering?

Item	Detail from the letter
Service	Credit monitoring and identity protection through TransUnion, with identity restoration
Enrollment deadline	December 31, 2026, with the unique code printed on the letter
Help line	833-516-9566, Monday to Friday, 8 a.m. to 8 p.m. Eastern Time, except major U.S. holidays

The guide to credit monitoring offers compares offers like this one.

Did OneMain tell investors?

Not specifically. The letter names no parent company. OneMain Holdings, Inc., the listed company with the OneMain name, files reports with the SEC. Its quarterly report for July to September 2026, filed October 30, mentions cyber incidents only in its general list of risks. It has filed no 8-K about a breach.

What Washington's attorney general recorded

Washington's attorney general lists a report from OneMain Financial Group, LLC, received on September 17, 2026, with 2,928 Washington residents affected and a breach date of May 5, 2026. For those residents the record lists names, Social Security numbers, financial and banking information and dates of birth as compromised.

What the documents leave open

• When OneMain discovered the activity, and how it began.
• The data element cut off in the filed letter.
• Whether the 122,783 are current customers, former customers or applicants.