The Money Store

Summary

The Money Store, a residential mortgage lender headquartered in Florham Park, New Jersey, identified unusual activity in its information technology environment after an unauthorized third party accessed part of the environment through a remote monitoring and management platform used by a third-party service provider. The intruder accessed and acquired residential mortgage loan files containing origination, underwriting, and closing documentation, exposing personal information such as names, Social Security numbers, driver's license numbers, government-issued identification numbers, financial account information, medical information, and dates of birth. A ransomware group claimed responsibility on a dark web site, stating it had obtained approximately 229 GB of data and threatening to publish it. The company notified federal law enforcement and began mailing notification letters to affected individuals, including customers and their dependents whose information appeared in tax documents submitted during loan origination.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On September 9, 2026, MLD Mortgage Inc., doing business as The Money Store, identified unusual activity within its information technology environment. The company operates as a family-owned residential mortgage lender headquartered in Florham Park, New Jersey. Its investigation determined that, beginning on or about September 8, 2026, an unauthorized third party accessed part of the environment through a remote monitoring and management platform used by a third-party service provider. The intruder accessed and acquired information from the affected systems, including residential mortgage loan files containing origination, underwriting, and closing documentation. Following the discovery, The Money Store engaged independent cybersecurity specialists and notified federal law enforcement. On September 21, 2026, a ransomware group known as Storm claimed responsibility on a dark web site, stating it had obtained approximately 229 GB of the company's data and threatening to publish it.

The personal information involved may include names, Social Security numbers, driver's license numbers, government-issued identification numbers such as passport or state ID card numbers, financial information such as account numbers and credit or debit card numbers, medical information, and dates of birth. Because the affected files were mortgage loan records, dependents whose information appeared in tax documents submitted during loan origination may also be affected. The investigation focuses on people connected to The Money Store, including customers and their dependents, whose personal information the company maintained. The company reported the breach to the California, Massachusetts, and Texas Attorneys General and began mailing notification letters on October 15, 2026. So far, 1,367 Texas residents and 1,248 Massachusetts residents have been reported affected. Edelson Lechtzin LLP, a national class action law firm, is investigating data privacy claims arising from the breach and is evaluating potential class action claims on behalf of individuals whose data may have been compromised.

Sources

Sources available to members: 1 source.