District Court for the Eastern District of Virginia In re McLean Data Breach Litigation Case No. 3:25-cv-00461 NOTICE OF PROPOSED CLASS ACTION SETTLEMENT IF YOUR PRIVATE INFORMATION WAS COMPROMISED IN THE OCTOBER 2024 MCLEAN MORTGAGE CORPORATION DATA BREACH, A PROPOSED CLASS ACTION SETTLEMENT MAY AFFECT YOUR RIGHTS, AND ENTITLE YOU TO BENEFITS AND A CASH PAYMENT. A court has authorized this notice. This is not a solicitation from a lawyer. You are not being sued. Please read this Notice carefully and completely. • A Settlement has been reached with McLean Mortgage Corporation (“McLean” or “Defendant”) in a class action lawsuit. This case is about the targeted cyberattack on McLean's computer systems that occurred in October 2024 (the “Data Breach”). Certain files that contained private information were potentially accessed. These files may have contained personal information such as names; Social Security numbers; driver’s license numbers; financial account numbers; passport numbers; health insurance information; and other personally identifiable information that Defendant may have collected and maintained. • The lawsuit is called In re McLean Data Breach Litigation, Case No. 3:25-cv-00461. It is pending in the District Court for the Eastern District of Virginia (the “Litigation”). • McLean denies that it did anything wrong, and the Court has not decided who is right. • The parties have agreed to settle the lawsuit (the “Settlement”) to avoid the costs and risks, disruptions, and uncertainties of continuing the Litigation. • If you received notice of the Settlement or the Data Breach, McLean's records indicate that you are a Class Member and are entitled to benefits under the Settlement. • Your rights are affected whether you act or don’t act. Please read this Notice carefully and completely. In re McLean Data Breach Litigation Page 1 of 10 CaseID: 9596 Questions? Call (833) 200-6767 Toll-Free or Visit www.McLeanDataSettlement.com SUMMARY OF YOUR LEGAL RIGHTS AND OPTIONS IN THIS SETTLEMENT DEADLINE SUBMIT A CLAIM The only way to receive benefits or payments from this Settlement December 10, 2026 is by submitting a valid and timely Claim Form. The fastest way to submit your Claim Form is online at www.McLeanDataSettlement.com. If you prefer, you can download the Claim Form from the Settlement Website and mail it to the Settlement Administrator. You may also call or email the Settlement Administrator to receive a paper copy of the Claim Form. OPT OUT OF THE You can choose to opt out of the Settlement and receive no benefit November 10, 2026 SETTLEMENT or payment. This option allows you to sue, continue to sue, or be part of another lawsuit against the Defendant related to the legal claims resolved by this Settlement. You can hire your own lawyer at your own expense. OBJECT TO THE If you do not opt out of the Settlement, you may object to it by November 10, 2026 SETTLEMENT AND/OR writing to the Court about why you don’t like the Settlement. You may also ask the Court for permission to speak about your ATTEND A HEARING objection at the Final Approval Hearing. If you object, you may also file a claim for Settlement benefits. DO NOTHING Unless you opt out of the Settlement, you are automatically part of No Deadline the Settlement. If you do nothing, you will not receive benefits or payments from this Settlement and you will give up the right to sue, continue to sue, or be part of another lawsuit against the Defendant related to the legal claims resolved by this Settlement. • These rights and options—and the deadlines to exercise them—are explained in this Notice. • The Court in charge of this case still has to decide whether to approve the Settlement. In re McLean Data Breach Litigation Page 2 of 10 CaseID: 9596 Questions? Call (833) 200-6767 Toll-Free or Visit www.McLeanDataSettlement.com WHAT THIS NOTICE CONTAINS BASIC INFORMATION .................................................................................................... 3 WHO IS IN THE SETTLEMENT .......................................................................................... 4 THE SETTLEMENT BENEFITS........................................................................................... 4 SUBMITTING A CLAIM FORM FOR SETTLEMENT BENEFITS ................................................ 6 THE LAWYERS REPRESENTING YOU ............................................................................... 6 EXCLUDING YOURSELF FROM THE SETTLEMENT ............................................................ 7 COMMENTING ON OR OBJECTING TO THE SETTLEMENT.................................................. 8 THE COURT’S FINAL APPROVAL HEARING ...................................................................... 8 IF I DO NOTHING ........................................................................................................... 9 GETTING MORE INFORMATION ...................................................................................... 9 Basic Information 1. Why was this Notice issued? The District Court for the Eastern District of Virginia, authorized this Notice. You have a right to know about the proposed Settlement of this class action lawsuit, and about all of your options, before the Court decides whether to grant final approval of the Settlement. This Notice explains the lawsuit, your legal rights, what benefits are available, and who can receive them. The lawsuit is called In re McLean Data Breach Litigation, Case No. 3:25-cv-00461. It is pending in the District Court for the Eastern District of Virginia. The people that filed this lawsuit are called the “Plaintiffs” (or “Class Representatives”) and the company they sued, McLean Mortgage Corporation, is called the “Defendant.” 2. What is this lawsuit about? This lawsuit alleges that during the October 2024 targeted cyberattack on McLean's computer systems, certain files that contained private information were potentially accessed. These files may have contained personal information such as names; Social Security numbers; driver’s license numbers; financial account numbers; passport numbers; health insurance information; and other personally identifiable information that Defendant may have collected and maintained. 3. What is a class action? In a class action, one or more individuals sue on behalf of other people with similar claims. These individuals are called the “Plaintiffs” or “Class Representatives.” Together, the people included in the class action are called a “Class” or “Class Members.” One court resolves the lawsuit for all Class Members, except for those who opt out from the settlement. In this Settlement, the Class Representatives are Jayaprakash Radhakrishnan; Micah Parks; and Priscilla Millberry. Everyone included in this Action are the Class Members. 4. Why is there a Settlement? The Court did not decide whether the Plaintiffs or the Defendant are right. Both sides have agreed to a Settlement to avoid the costs and risks of a trial, and to allow the Class Members to receive benefits from the Settlement. The Plaintiffs and their attorneys think the Settlement is best for all Class Members. In re McLean Data Breach Litigation Page 3 of 10 CaseID: 9596 Questions? Call (833) 200-6767 Toll-Free or Visit www.McLeanDataSettlement.com Who is in the Settlement? 5. Who is included in the Settlement? The court has defined the Class this way: “All living persons residing in the United States whose PII was potentially compromised in the Data Incident experienced by McLean on or around October 17, 2024, including all persons who were sent a notice letter regarding the Data Incident.” In this sentence, PII means Personally Identifiable Information. 6. Are there exceptions to being included? Yes. Excluded from the Class are: (1) McLean’s officers, directors, and entities in which McLean has a controlling interest; (2) McLean’s affiliates, legal representatives, attorneys, successors, heirs, and assigns; and (3) the Judge in this case, and the Judge’s family and staff. If you are not sure whether you are a Class Member, you can ask for free help any time by contacting the Settlement Administrator at: • Email: info@McLeanDataSettlement.com • Call toll free, 24/7: (833) 200-6767 • By mail: McLean Data Breach Settlement c/o Settlement Administrator P.O. Box 25226 Santa Ana, CA 92799-9958 You may also view the Settlement Agreement at www.McLeanDataSettlement.com. The Settlement Benefits 7. What does the Settlement provide? All Settlement Class Members are eligible to claim Credit Monitoring and Identity Theft Protection and one or more of the cash payment options. These benefits are described in more detail below. CREDIT MONITORING AND IDENTITY THEFT PROTECTION. All Class Members are eligible to claim three years of CyEx Financial Shield Complete one-bureau credit monitoring. Enrollment codes and instructions will be sent by email to all Class Members who claim this benefit. Your CyEx Financial Shield Complete subscription will become active once you enroll. This comprehensive service comes with $1 million of financial fraud insurance, and includes monitoring for: • fraud or identity theft • unauthorized financial transactions • personal information associated with high-risk transactions If anything suspicious happens, you will be able to talk to a fraud resolution agent to help fix any problems. CASH PAYMENT OPTIONS Ordinary Documented Losses and Expenses. If you incurred actual, documented, and unreimbursed out-of-pocket expenses due to the Data Breach, you can get back up to $1,000.00. The losses must have occurred between October 17, 2024, and December 10, 2026. In re McLean Data Breach Litigation Page 4 of 10 CaseID: 9596 Questions? Call (833) 200-6767 Toll-Free or Visit www.McLeanDataSettlement.com This benefit covers out-of-pocket expenses like: • fees for credit reports, credit monitoring, or freezing and unfreezing your credit • cost to replace your IDs • postage to contact banks by mail You need to send proof, like receipts, to show how much you spent or lost. You can also send notes or papers you made yourself to explain or support other proof, but those notes or papers alone are not enough to make a valid claim. Your proof or notes should show that your expenses were because of the Data Incident. You cannot claim a payment for expenses that have already been reimbursed by a third party. Extraordinary Losses. If you lost money because of identity theft or fraud, you can get back up to $4,000.00. You will need to show that: • the theft or fraud was directly caused by the Data Breach • the losses are not already covered by Out-of-Pocket Expenses • you tried to prevent the loss or get your money back, such as by using insurance you already have or requesting relief from your financial institution’s consumer fraud policies The losses must have occurred between October 17, 2024, and December 10, 2026. You need to send proof, like police reports, submitted insurance claims, or receipts, to show how much you spent or lost and that your loss was the result of actual fraud or identity theft. You can also send notes or papers you made yourself to explain or support other proof, but those notes or papers alone are not enough to make a valid claim. Your proof or notes should show that your expenses were because of the Data Incident. You cannot claim a payment for expenses that have already been reimbursed by a third party. Reimbursement for Lost Time. Class Members who spent time responding to problems caused by the Data Breach may claim up to four hours, at $25.00 per hour, for a maximum of $100.00. You must have spent the time on tasks related to the Data Breach. Some examples include things like: • changing your passwords • investigating suspicious activity in your accounts • researching the Data Breach If you claim Ordinary Documented Losses and Expenses, the combined total is capped at $1,000.00. You will need to sign a statement, under penalty of perjury, attesting that you spent the time claimed responding to issues raised by the Data Breach and reasonably describing how you spent that time. Alternative Cash Payment. Instead of any other payments, you may claim a one-time $45.00 cash payment. You do not have to provide any proof or explanation to claim this payment. If you have questions about these benefits, you can ask for free help any time by contacting the Settlement Administrator at: • Email: info@McLeanDataSettlement.com In re McLean Data Breach Litigation Page 5 of 10 CaseID: 9596 Questions? Call (833) 200-6767 Toll-Free or Visit www.McLeanDataSettlement.com • Call toll free, 24/7: (833) 200-6767 • By mail: McLean Data Breach Settlement c/o Settlement Administrator P.O. Box 25226 Santa Ana, CA 92799-9958 8. What claims am I releasing if I stay in the Class? If you stay in the class, you won’t be able to be part of any other lawsuit against McLean about the issues that this Settlement covers. The “Release” section of the Settlement Agreement (Section VI) describes the legal claims that you give up if you remain in the Class. The Settlement Agreement is available at www.McLeanDataSettlement.com. Submitting a Claim Form for a Settlement Payment 9. How do I submit a claim for a Settlement benefit? The fastest way to submit your Claim Form is online at www.McLeanDataSettlement.com. If you prefer, you can download a printable Claim Form from the website and mail it to the Settlement Administrator at: McLean Data Breach Settlement c/o Settlement Administrator P.O. Box 25226 Santa Ana, CA 92799-9958 You may also contact the Settlement Administrator to request a Claim Form by telephone, toll free, (833) 200-6767, by email info@McLeanDataSettlement.com, or by U.S. mail at the address above. 10. Are there any important Settlement payment deadlines? If you are submitting a Claim Form online, you must do so by December 10, 2026. If you are submitting a claim by U.S. mail, the completed and signed Claim Form, including supporting documentation, must be postmarked no later than December 10, 2026. 11. When will the Settlement benefits be issued? The Court will hold a final approval hearing on December 10, 2026 (see Question 18). If the Court approves the Settlement, there may be appeals. We do not know if appeals will be filed, or how long it will take to resolve them if they are filed. Settlement payments will be distributed if the Court grants final approval, and after any appeals are resolved. The Lawyers Representing You 12. Do I have a lawyer in the case? Yes, the Court has appointed attorneys David K. Lietz of Milberg, PLLC and A. Brooke Murphy of Murphy Law Firm, to represent you and other Class Members (“Class Counsel”). In re McLean Data Breach Litigation Page 6 of 10 CaseID: 9596 Questions? Call (833) 200-6767 Toll-Free or Visit www.McLeanDataSettlement.com 13. Should I get my own lawyer? You will not be charged for Class Counsel’s services. If you want your own lawyer, you may hire one at your expense. 14. How will Class Counsel be paid? Class Counsel will ask the court to approve $250,000.00 as reasonable attorneys' fees and reimbursement of litigation costs. This amount will be paid by McLean. Class Counsel will also ask for Service Award payments of $2,500.00 for each of the Class Representatives. Service Award payments will also be paid by McLean. Excluding Yourself from the Settlement 15. How do I opt out of the Settlement? If you do not want to be part of the Settlement, you must formally exclude yourself from the Settlement. This is called a Request for Exclusion, and is sometimes also called “opting out.” If you opt out, you will not receive Settlement benefits or payment. However, you will keep any rights you may have to sue McLean on your own about the legal issues in this case. If you exclude yourself, you are telling the Court that you do not want to be part of the Settlement. You will not be eligible to receive any Settlement benefits if you exclude yourself. The deadline to exclude yourself from the Settlement is November 10, 2026. To be valid, your Request for Exclusion must have the following information: (1) the name of the Litigation: In re McLean Data Breach Litigation, Case No. 3:25-cv-00461, pending in the District Court for the Eastern District of Virginia; (2) your full name, mailing address, telephone number, and email address (if any); (3) your wet (written) signature; and (4) the words “Request for Exclusion” or a clear and similar statement that you do not want to participate in the Settlement. You may only exclude yourself—not any other person. Mail your Request for Exclusion to the Settlement Administrator at: McLean Data Breach Settlement ATTN: Exclusion Request P.O. Box 25226 Santa Ana, CA 92799-9958 Your Request for Exclusion must be postmarked by November 10, 2026. In re McLean Data Breach Litigation Page 7 of 10 CaseID: 9596 Questions? Call (833) 200-6767 Toll-Free or Visit www.McLeanDataSettlement.com Commenting on or Objecting to the Settlement 16. How do I tell the Court if I like or do not like the Settlement? If you are a Class Member and do not like part or all of the Settlement, you can object to it. Objecting means telling the Court your reasons for why you think the Court should not approve the Settlement. The Court will consider your views. You cannot object if you have excluded yourself from the Settlement (see Question 15). You must provide the following information for the Court to consider your objection: (1) the name of the Litigation: In re McLean Data Breach Litigation, Case No. 3:25-cv-00461, pending in the District Court for the Eastern District of Virginia; (2) your full name, mailing address, telephone number, and email address (if any); (3) a clear description of all the reasons you object, with any factual and legal support you may have for your objection; include any supporting materials, such as documents; (4) if you have objected in any other cases in the past four years, list the names, courts, and civil action numbers for each of those cases and provide copies of any orders related to or ruling upon your objections that were issued by the trial or appellate court(s) in those cases; (5) whether or not you would like to speak at the Final Approval Hearing; (6) if you are represented by an attorney, the name and telephone number of your attorney and, if your attorney or their law firm has objected in any other cases in the past four years, list the names, courts, and civil action numbers for each of those cases and provide copies of any orders related to or ruling upon your attorney’s or their law firm’s objections that were issued by the trial or appellate court(s) in those cases; (7) if you are represented by an attorney, whether your attorney intends to appear at the Final Approval Hearing; (8) the identity of any witnesses you may call to testify at the Final Approval Hearing and copies all exhibits you intend to introduce into evidence at the Final Approval Hearing; and (9) your wet (written) signature (if you have hired your own lawyer, their signature is not sufficient). For your objection to be valid, it must meet each of these requirements. To be considered by the Court, you must file your complete objection with the Clerk of Court by November 10, 2026. You must also mail a copy of the objection and any papers submitted in support of the objection to the Settlement Administrator postmarked by November 10, 2026. Clerk of the Court Settlement Administrator U.S. District Court for the Eastern District of McLean Data Breach Settlement Virginia, Richmond Division ATTN: Objections ATTN: Clerk of Court P.O. Box 25226 701 East Broad Street Santa Ana, CA 92799-9958 Richmond, VA 23219 In re McLean Data Breach Litigation Page 8 of 10 CaseID: 9596 Questions? Call (833) 200-6767 Toll-Free or Visit www.McLeanDataSettlement.com 17. What is the difference between objecting and excluding? Objecting is telling the Court that you do not like something about the Settlement. You can object to the Settlement only if you do not exclude yourself from the Settlement. Excluding yourself from the Settlement is opting out and stating to the Court that you do not want to be part of the Settlement. If you opt out of the Settlement, you cannot object to it because the Settlement no longer affects you. The Court’s Final Approval Hearing 18. When is the Court’s Final Approval Hearing? The Court will hold a final approval on December 10, 2026, at 11:00 a.m. Eastern Time, in Room 6100 of the U.S. District Court for the Eastern District of Virginia, Richmond Division, Spottswood W. Robinson III and Robert R. Merhige, Jr. Federal Courthouse, at 701 East Broad Street, Richmond, VA 23219, or via Zoom or other virtual meeting platform at the Court’s discretion. At the final approval hearing, the Court will decide whether to approve the Settlement. The court will also decide how Class Counsel should be paid, and whether to award Service Award payments to the Class Representatives. The Court will also consider any objections to the Settlement. If you are a Class Member, you or your lawyer may ask permission to speak at the hearing at your own cost (See Question 16). The date and time of this hearing may change without further notice. Please check www.McLeanDataSettlement.com for updates. 19. Do I have to come to the Final Approval Hearing? No. Class Counsel will answer any questions the Court may have. You may attend at your own expense if you wish, but you do not have to. If you file an objection, you do not have to come to the Final Approval Hearing to talk about it; the Court will consider it as long as it was filed on time. You may also pay your own lawyer to attend, but you do not have to. If I Do Nothing 20. What happens if I do nothing at all? If you do nothing, you will not receive a benefit from this Settlement. You will also give up the rights described in Question 8. Getting More Information 21. How do I get more information? This Notice is a summary of the proposed Settlement. The full Settlement Agreement and other related documents are available at the Settlement Website, www.McLeanDataSettlement.com. In re McLean Data Breach Litigation Page 9 of 10 CaseID: 9596 Questions? Call (833) 200-6767 Toll-Free or Visit www.McLeanDataSettlement.com If you have additional questions, you can ask for free help any time by contacting the Settlement Administrator at: • Email: info@McLeanDataSettlement.com • Call toll free, 24/7: (833) 200-6767 • By mail: McLean Data Breach Settlement c/o Settlement Administrator P.O. Box 25226 Santa Ana, CA 92799-9958 You can obtain copies of publicly filed documents by visiting the office of the Clerk of the Court, U.S. District Court for the Eastern District of Virginia, Richmond Division, 701 East Broad Street, Richmond, VA 23219. DO NOT CONTACT THE COURT OR CLERK OF COURT REGARDING THIS SETTLEMENT In re McLean Data Breach Litigation Page 10 of 10 CaseID: 9596 Questions? Call (833) 200-6767 Toll-Free or Visit www.McLeanDataSettlement.com