LendUS data breach: what happened and what to do

LendUS, a mortgage lender, said an unauthorized person accessed some employee email accounts between February 2 and March 22, 2021. Exposed data included Social Security and driver's license numbers and financial account details. Notices went out in early 2022.

View all 13,177 breaches

Breach date: 2 Feb 2021
Made public: 19 Jan 2022
Data exposed: Social security numbers, Driver's licenses, Financial account information, Payment card information
Last updated: 28 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

LendUS is a U.S. mortgage lender. After an investigation, it determined that an unauthorized person accessed certain employee email accounts at various times between February 2 and March 22, 2021. The company found that emails or attachments in those accounts held personal information of employees and customers.

LendUS began notifying people in January 2022. The Washington Attorney General's list shows 696 Washington residents affected. That count covers one state only, so the total number of people is larger and the notice sources reviewed don't give it.

Sources checked: atg.wa.gov, maine.gov, nationalmortgagenews.com

Last verified against the official page: 28 Oct 2026

How we research this Report an error

What was exposed

Filings describe Social Security numbers, driver's license numbers, financial and payment card account information and online account credentials.

For a mortgage lender, that combination is serious. A Social Security number and driver's license number are enough to open accounts in your name, and financial account details can be used for fraud against your existing accounts.

The company's response

LendUS set up a call center and offered free credit monitoring to people whose data was involved. A class action over the breach was settled, with class members able to claim up to $500 for documented losses. LendUS did not admit wrongdoing.

What to do

If you got a letter, use the monitoring offer. If you applied for or held a loan with LendUS around 2021 and got no letter, ask the company directly.

What to do if you were in it

1

Change passwords and watch financial accounts

Online account credentials were among the data listed, so change passwords for any account you shared with a lender, and anywhere you reused them. Turn on two-factor login, and check bank and card statements for charges you don't recognize.
2

Freeze your credit at all three bureaus

A credit freeze is free and blocks most new accounts opened in your name. You place it separately at Equifax, Experian and TransUnion, and the FTC explains how at consumer.ftc.gov. Lift it only when you apply for credit yourself.
3

Watch your statements and credit reports

Check bank, card and insurance statements for charges or claims you don't recognize. You can get free credit reports at AnnualCreditReport.com. If you find misuse, report it at IdentityTheft.gov.
4

Expect phishing that mentions the breach

Scammers use news of a breach to sound legitimate. Don't click links in unexpected emails or texts about it. Go to the company's own site, or call a number printed on your letter or card.
5

Check whether your email or phone is in this and other breaches

Run a free Serus scan to see which breaches your email or phone number appear in. Serus monitors breach databases and the dark web and alerts you when your data shows up, though it can't remove data from a breach.

Official filings

Washington Attorney General , filed 19 Jan 2022 : 696 people

Timeline

2 Feb 2021
The breach happened
19 Jan 2022
The company made it public
19 Jan 2022
Reported to the Washington Attorney General

Frequently asked

Was I affected by the LendUS breach?

LendUS sent notices to the people whose information was in the accessed email accounts. If you dealt with LendUS around 2021 and got no letter, ask the company directly.

What was exposed?

Filings describe Social Security numbers, driver's license numbers, financial and payment card account information and online account credentials.

How many people were affected?

The Washington Attorney General's list shows 696 Washington residents. That is one state's count, not the total.

Is there a settlement?

Yes. National Mortgage News reports LendUS agreed to settle a class action, with class members able to claim up to $500 in reimbursement for documented losses.