American Lending Center

Summary

American Lending Center, a California-based non-bank lender managing a $3 billion portfolio of government-guaranteed small business loans, experienced a ransomware attack that compromised its network and exposed personal data including names, dates of birth, and Social Security numbers of approximately 123,000 individuals. A forensic investigation determined that an unauthorized actor accessed files containing the information, though no evidence of misuse has been found and no ransomware group has claimed responsibility for the incident.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

American Lending Center is a California-based non‑bank lender that manages a $3 billion portfolio specializing in government‑guaranteed small business loans and was established in 2009 to provide small business and investment financing nationwide. Between July 24 and 30 2025 the company experienced a ransomware‑related incident in which an unauthorized actor infiltrated its internal network, deployed ransomware, and accessed files that may have contained personal identifying information. A forensic investigation concluded on April 8 2026 determined that approximately 123,158 individuals were affected, with exposed data including names, dates of birth, and Social Security numbers. American Lending Center notified those individuals that the information may have been stolen and submitted a copy of the notification to the Maine attorney general’s office. The company stated that its investigation found no evidence that the potentially compromised information had been misused. SecurityWeek sought comment from American Lending Center regarding the breach and noted that no known ransomware group had claimed responsibility for the attack.

Edelson Lechtzin LLP, a national class action law firm with offices in Pennsylvania and California, launched an investigation into the exposure of personal information stemming from the American Lending Center data breach. The firm is evaluating whether to pursue a class action lawsuit on behalf of individuals whose sensitive personal data may have been compromised and will assess potential claims at no cost to affected persons. The law firm handles a range of class and collective actions, including securities and investment fraud, federal antitrust violations, ERISA employee benefit plans, wage theft, and consumer fraud. American Lending Center’s notification to impacted customers indicated that the breach was discovered through a forensic investigation that identified the threat actor’s network compromise, ransomware deployment, and file access. The notification also noted that the investigation was completed on April 8 2026 and that the company found no evidence of misuse of the data.

The breach affected individuals across the United States who had interacted with American Lending Center’s lending services, and the company continues to be a private lender focused on government‑guaranteed small business loans. No further details about the attacker’s identity, motives, or any potential ransom payment have been disclosed in the available sources. The incident remains under review by the law firm as it determines the viability of legal remedies for those whose personal information was exposed.

Sources

Sources available to members: 2 sources.