Academy Mortgage

Summary

Academy Mortgage had previously settled federal charges for $38.5 million related to mortgage underwriting fraud. It later suffered a ransomware attack by the AlphV (BlackCat) group that exfiltrated customer, financial and personal data, and agreed to a $2 million settlement to resolve a class action alleging it failed to protect the personal information of over 284,000 individuals.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Months before May 2023, Academy Mortgage settled a False Claims Act case for $38.5 million related to improper mortgage underwriting. On May 14, 2023, the ransomware group AlphV (BlackCat) added Academy Mortgage to its leak site. BlackCat claimed it had been inside the company's network for a long time and had studied its business. The group stated it had stolen confidential data, including customer and partner information, personal data, financial records, and other sensitive files. As proof, BlackCat posted screencapped files showing images of drivers' licenses, internal documents, and statements. The post did not indicate whether BlackCat had encrypted any files or merely exfiltrated copies. Academy Mortgage did not publish any public statement about the incident on its website. When contacted by DataBreaches, Academy did not immediately reply to requests for confirmation or additional details.

The exposed data reportedly included personal information of more than 284,000 individuals. This exposure led to a proposed class action lawsuit alleging that Academy Mortgage negligently failed to protect that information. On August 26, 2026, Academy Mortgage agreed to pay nearly $2 million under a proposed settlement filed in federal court. The settlement would provide class members with up to $3,000 in reimbursement for documented losses related to the breach or a pro rata cash payment. The agreement is subject to approval by Judge David Barlow of the US District Court for the District of Utah. The settlement resolves the claims arising from the 2023 data breach.

Sources

Sources available to members: 2 sources.