Cyber Incident Victim: Smart Mortgage
Date:
Dec 2020
Location:
United States of America
Summary
Smart Mortgage filed a lawsuit against a former senior loan processor and NEXA Mortgage, alleging the employee stole a client database containing names and personal information upon joining the competing firm. The brokerage pursued parallel legal actions in both federal and Illinois state courts, claiming unauthorized data transfer impacted operations across multiple states.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In December 2020, Smart Mortgage, a brokerage operating across Illinois, Indiana, Colorado, and Florida, filed a federal lawsuit in Illinois against former senior loan processor Brian Noe and NEXA Mortgage. The legal action alleged Noe stole a client database containing names and associated information upon departing Smart Mortgage for NEXA Mortgage. The complaint positioned NEXA as potentially benefiting from or failing to prevent the unauthorized transfer of proprietary data. This federal suit mirrored an earlier state-level case initiated by Smart Mortgage in Illinois courts, establishing parallel legal proceedings addressing the same core allegations. The incident centered on the unauthorized exfiltration of sensitive business records by an employee transitioning to a competitor.
Smart Mortgage's response focused exclusively on litigation, seeking legal redress for the alleged data misappropriation. No public disclosures indicated whether affected clients were notified of the potential compromise of their information. The lawsuits did not specify the exact volume of records taken, the precise data elements involved beyond client names, or whether the information was exploited post-theft. NEXA Mortgage's stance on the allegations remained undisclosed in the available reporting. The case highlighted risks associated with employee access to sensitive databases during career transitions, though no regulatory investigations or additional fallout beyond the court filings were documented at the time of reporting.