LoanDepot Breach 17 Million: Mortgage Data and SSNs Exposed in Ransomware Attack

LoanDepot, one of the largest nonbank mortgage lenders in the US, suffered a ransomware attack that exposed the personal data of approximately 16.9 million customers. The breach compromised names, Social Security numbers, dates of birth, financial account numbers, and phone numbers. The attack forced LoanDepot to take systems offline, preventing customers from making mortgage payments and accessing their accounts for days. Homeowners reported inability to process loan payments, check balances, or complete real estate transactions during the outage. The breach was particularly concerning because mortgage data includes comprehensive financial profiles: income levels, property addresses, employment history, credit scores, and banking information. LoanDepot offered affected customers two years of credit monitoring and identity protection. The incident highlighted the cybersecurity vulnerabilities in the mortgage industry, where companies hold deeply sensitive financial data but may not invest commensurately in security infrastructure.

The ramifications of this incident extend beyond the immediate data exposure. Privacy regulators in multiple jurisdictions have opened investigations, and affected individuals are organizing collective action to demand accountability and meaningful remediation. The case highlights systemic weaknesses in how organizations handle personal data and the gap between corporate privacy promises and operational reality.

For impacted individuals, immediate action is critical. Filing a data subject access request forces the company to disclose exactly what data they hold about you, providing the foundation for deletion requests, regulatory complaints, and potential legal action. Below, we outline the specific data types at risk and the concrete steps you can take to protect yourself.