Real estate heavyweight Redfin and its parent company, Rocket, face a potential class-action lawsuit over allegations that a data breach exposed private information of current and former employees.

Frankie Moreno, a former Redfin employee, argues that a security lapse with the companies' computer systems has led to fraud, financial losses and the threat of further harm to herself and others.

Moreno sued in U.S. District Court for the Western District of Washington on Wednesday. Her attorney, Kaleigh Boyd, declined to comment Friday, saying she was not authorized to do so.

Seattle-based Redfin is a subsidiary of Rocket Companies. Rocket Companies, a financial technology and homeownership services company based in Detroit, acquired Redfin last year. Another subsidiary, Rocket Limited Partnership, oversees Rocket Mortgage, Rocket Loans, Rocket Close and Rocket Money.

When asked for comment, Rocket pointed to a statement by Redfin.

“In early March, Redfin identified suspicious activity involving a single employee account, a Redfin spokesperson said Friday. "Redfin promptly engaged forensic experts, and its systems were reviewed and confirmed secure."

They said potentially affected individuals were notified and offered two years of complimentary credit monitoring. "The company is confident it will prevail in the related litigation once all the facts are presented," the spokesperson added.

Pressing for class action

Moreno is hoping to receive class-action certification, along with financial restitution.

The lawsuit accuses Redfin and Rocket of not taking "reasonable and adequate data security measures" to prevent a breach, leading to a violation of the Washington Consumer Protection Act.

Attorneys for Moreno said cybercriminals caused the breach.

The exposed private information allegedly included names, Social Security numbers, driver’s license numbers and financial account information, according to the lawsuit. It claims: "The unencrypted Private Information of Class Members has already ended up, or will end up, for sale on the dark web."

Moreno, a Texas resident, worked for Redfin from September 2020 to November 2022. The breach resulted in a "dramatic increase in spam," per the lawsuit.

Her lawyers are pressing for the class to span American employees for the companies whose private information was compromised, based on the belief this could include thousands of people.

The attorneys argue that the companies did not disclose when the transgression occurred, how long the unauthorized party had access, when the breach was discovered, how it happened or what information was taken.

Instead, they said Redfin filed a notice about the incident with the Massachusetts Office of Consumer Affairs and Business Regulation last month.

The notice, which was reviewed by The Seattle Times, provides a broad statement about a security incident at Redfin that "may have resulted in an unauthorized third party accessing your personal information, without offering further details.

©2026 The Seattle Times. Visit seattletimes.com. Distributed by Tribune Content Agency, LLC.