MLD Mortgage Inc.

Summary

Beginning on or about September 8, 2026, an unauthorized third party accessed MLD Mortgage Inc. (The Money Store) through a third-party service provider's remote monitoring platform and acquired residential mortgage loan files containing customer and dependent information. The ransomware group Storm claimed responsibility on September 21, saying it obtained approximately 229 GB.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On or about September 8, 2026, an unauthorized third party accessed part of The Money Store’s information technology environment through a remote monitoring and management platform used by a third-party service provider. The Money Store identified unusual activity within its environment on September 9. During its investigation, the company determined that the intruder accessed and acquired information from affected systems. The affected records included residential mortgage loan files containing documentation created during loan origination, underwriting, and closing. The breach therefore exposed information associated with active and completed mortgage lending activities rather than a limited set of externally accessible customer records. The Money Store engaged independent cybersecurity specialists to investigate the incident and notified federal law enforcement.

On September 21, 2026, a ransomware group known as Storm claimed responsibility for the intrusion. Storm stated on a dark web site that it had obtained approximately 229 gigabytes of The Money Store’s data. The group also threatened to publish the acquired information. The claim linked the ransomware group to the theft of mortgage-related data identified during the company’s investigation. At the time of the incident reporting, the source did not describe evidence of fraudulent transactions, identity misuse, or the publication of the stolen information.

According to The Money Store, the personal information involved may include names, Social Security numbers, driver’s license numbers, and government-issued identification numbers such as passport or state identification card numbers. The exposed information may also include financial data, including account numbers and credit or debit card numbers, as well as medical information and dates of birth. Because the affected systems contained residential mortgage loan files, some information may have come from documents submitted by applicants or borrowers during the lending process. Dependents whose information appeared in tax documents provided during loan origination may also have been affected. The investigation focused on customers and their dependents whose personal information was maintained by the company.

The Money Store reported the breach to the Attorneys General of California, Massachusetts, and Texas. It began mailing notification letters to affected individuals on October 15, 2026. As of the incident report, The Money Store had reported that 1,367 Texas residents and 1,248 Massachusetts residents were affected. The notification process included providing recipients with an enrollment code associated with the breach notice. The affected population consisted of people connected to The Money Store whose information appeared in mortgage records, including borrowers and potentially their dependents.

Following the disclosure of the incident, Edelson Lechtzin LLP announced that it was investigating potential data privacy and class action claims arising from the breach. The firm said its investigation covered individuals who received breach notices or otherwise believed their information may have been exposed. The company’s engagement of independent cybersecurity specialists, notification of federal law enforcement, regulatory reporting in three states, and commencement of individual mail notifications formed the documented response to the intrusion.

Sources

Sources available to members: 1 source.