Mortgage Servicer Faces Class Action After Data Breach

National Mortgage Professional reports that customers are suing Mr. Cooper Group, a Dallas-based mortgage servicer. They allege negligence in safeguarding personal data from an Oct. 31 cyberattack.

According to the suit, the company failed to adhere to industry standards for safeguarding the personal information of 4.3 million individuals held within its systems.

An SEC filing reveals that the attack will cost the company a minimum of $5 to $10 million. Mr. Cooper Group had $937 billion in unpaid principal balance as of September.

The system was not restored for 12 days after the attack. The complaint claims the stolen information includes names, social security numbers, addresses, phone numbers, dates of birth, zip code, and state of residence.

The company initially advised customers to monitor their accounts and contact the three major credit bureaus to place a “fraud alert” on their files. It promised to mail notices to any affected customer and provide them with complimentary credit monitoring services.

According to a statement it issued, the company didn’t believe any customers’ banking information related to mortgage payments was impacted. It said accounts could be accessed through the website and automated phone and promised not to charge fees or penalties as a result of late payments.

“Any customer impact number reported in the media is speculation,” a company spokesperson said. “We continue to make great progress restoring our operations in a safe and secure manner, and are taking customer calls and payments.”

A senior credit officer at Moody’s told the New York Times that Moody’s was closely monitoring the incident. He said the ultimate impact would hinge on the duration of the disruptions, potential harm to Mr. Cooper’s reputation, and the scale of the security breach.