FPI Management Inc., a large property management company, agreed to a class action settlement tied to an August 2020 cyberattack discovered around Aug. 14, 2020, in which unauthorized parties accessed files containing residents’ and former residents’ sensitive information—such as Social Security numbers, driver’s license or passport numbers, financial account details, and in some cases medical information. Data incidents like this are especially serious in the housing industry because property managers collect and retain high-value identity data for applications, background checks, and rent payments, and a single breach can expose years of records across many properties. The lawsuit was filed because plaintiffs alleged FPI failed to implement reasonable safeguards to protect that information, increasing the risk of identity theft and violating California privacy and records laws, including the California Consumer Privacy Act (CCPA) and the Customer Records Act; FPI denied wrongdoing but chose to settle to avoid the cost and uncertainty of litigation. Under the settlement, eligible notified residents can seek reimbursement for ordinary out-of-pocket costs and time (up to $400 total, with time capped at three hours), documented extraordinary identity-theft losses (up to $4,250), and can elect two years of identity protection and credit monitoring, with an additional $100 cash payment available to certain claimants who received notice at a California mailing address. More broadly, the case reflects a familiar pattern in data-breach class actions: consumers argue that companies holding personal data must use “reasonable security” and provide remedies when a breach creates real-world risks, while defendants often settle without admitting liability to cap exposure and standardize relief. Similar lawsuits across sectors—retail, healthcare, financial services, and housing—have pushed organizations toward stronger security controls, shorter data-retention practices, better vendor oversight, and more robust incident response, all under increasing regulatory pressure from state breach-notification statutes and privacy frameworks like the CCPA that make security failures and delayed or inadequate responses more legally consequential.