Citywide Home Loans citywidehomeloans.com

Citywide Home Loans data breach: what happened and what to do

Citywide Home Loans, a mortgage lender, was hit by a ransomware attack that began on or about November 18, 2020 and was found on November 29, 2020. The company told people in 2021, and later settled a class action for $1.2 million.

View all 13,177 breaches
Breach date
18 Nov 2020
Made public
16 Feb 2021
Last updated

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

Citywide Home Loans is a US mortgage lender. In regulator filings it said an unauthorized party got into its network through its VPN gateway, using a Citywide employee's username and password. The attacker moved around inside the network and deployed ransomware, which encrypted a limited number of systems. The intrusion dates to on or about November 18, 2020, and the company found the ransomware on November 29, 2020.

Citywide took systems offline, brought in outside cybersecurity experts and reported the incident to law enforcement. It said its core business systems sit outside the affected data center, so operations weren't significantly disrupted.

How many people were affected is unclear. Its filings with the Maine Attorney General first listed 16,615 people and a later filing listed 220,245, so this page doesn't give a single total. California and Washington notices count only residents of those states.

A class action followed. According to HousingWire, Citywide agreed to a $1.2 million settlement that includes two years of credit monitoring and identity theft protection through Kroll, plus reimbursement for documented losses. Citywide denies any wrongdoing.

A mortgage lender holds the kind of details used for identity theft, so if you got a letter or applied for a loan there, treat it seriously and read the letter for what was involved.

Sources checked: maine.gov, housingwire.com, oag.ca.gov

Last verified against the official page:

How we research this Report an error

What to do if you were in it

  1. 1

    Read your notice letter

    It names the information involved in your case and any free credit monitoring offered. Use the monitoring if you got a code.

  2. 2

    Check your credit reports

    Get your free reports at AnnualCreditReport.com and look for accounts or inquiries you don't recognize.

  3. 3

    Place a fraud alert or credit freeze

    The FTC explains that a credit freeze is free and stops new credit being opened in your name. You place it with Equifax, Experian and TransUnion. See consumer.ftc.gov.

  4. 4

    Be wary of messages mentioning your loan

    Scammers use real lender details in phone calls, texts and emails. Contact your lender using a number from a statement or its official website, not from the message.

  5. 5

    Report identity theft if it happens

    Report it at IdentityTheft.gov and follow the recovery plan.

  6. 6

    Check whether your email or phone is in this and other breaches

    Serus runs a free scan that looks for your email and phone number in known breaches and alerts you if new ones appear.

Official filings

Timeline

  1. The breach happened

  2. The company made it public

  3. Reported to the Washington Attorney General

Frequently asked

Was I affected by the Citywide Home Loans breach?

If you received a notice letter, yes. If you had a loan application or loan with Citywide around late 2020 and got nothing, contact the company using details from its official website.

How many people were affected?

Reports differ. Citywide's Maine Attorney General filings list 16,615 people and later 220,245, so the total isn't settled.

Is there a settlement?

HousingWire reported a $1.2 million class action settlement with two years of Kroll credit monitoring and reimbursement of up to $5,000 for losses. Check for any current claim deadline before relying on it.

Should I change my password?

The sources describe an attack on company systems, not a leak of customer passwords. If you reuse a password on any lender account, change it and use a different one for each account, as the FTC advises.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Serus

Check if you're exposed in a breach with Serus

Find your leaks. Get alerted to new ones.

Run a free scan

Related articles

All articles

How to know if you have been hacked – 12 signs

What is the dark web? Definition and how it works

How to Prevent Data Breaches in 8 Ways

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.