Flagstar agrees to pay $3.6 million over cyberattack

Hicksville-based bank Flagstar Financial has agreed to pay $3.6 million to resolve allegations that it misled customers and investors about a cyberattack in which hackers stole the personal information of 1.5 million people.
The cyberattack took place in late 2021. Flagstar neither admitted nor denied the commission’s allegations, but it consented to the $3.5 million penalty and a cease-and-desist order barring it from making misleading statements in the future.