Mr. Cooper Mortgage Breach: 14 Million Homeowners Data Exposed

Mr. Cooper, one of the largest mortgage servicers in the United States, disclosed a cyberattack that compromised personal data of approximately 14.7 million current and former customers. The breach exposed names, Social Security numbers, dates of birth, addresses, and mortgage account details. The attack forced Mr. Cooper to take systems offline for days, preventing homeowners from making mortgage payments, accessing accounts, or contacting customer support during the outage. The timing was particularly harmful as it disrupted payment processing, potentially triggering late fees and credit reporting issues for customers unable to pay on time. Mr. Cooper confirmed that the attackers accessed and exfiltrated data but did not deploy ransomware. The company offered two years of identity monitoring to affected individuals. The breach was notable because Mr. Cooper services mortgages for customers who may have originally taken loans through different lenders, meaning many affected individuals had no direct relationship with Mr. Cooper and were unaware the company held their data.

The ramifications of this incident extend beyond the immediate data exposure. Privacy regulators in multiple jurisdictions have opened investigations, and affected individuals are organizing collective action to demand accountability and meaningful remediation. The case highlights systemic weaknesses in how organizations handle personal data and the gap between corporate privacy promises and operational reality.

For impacted individuals, immediate action is critical. Filing a data subject access request forces the company to disclose exactly what data they hold about you, providing the foundation for deletion requests, regulatory complaints, and potential legal action. Below, we outline the specific data types at risk and the concrete steps you can take to protect yourself.