LoanCare loancare.com LoanCare data breach: what happened and what to do
LoanCare, a mortgage servicer owned by Fidelity National Financial, told 1,316,938 people that hackers took their names, addresses, Social Security numbers and loan numbers. The company became aware of the access around November 19, 2023.
View all 13,115 breaches- Breach date
- 19 Nov 2023
- Made public
- 22 Dec 2023
- Affected
- 1,316,938
- Data exposed
- Names, Physical addresses, Social security numbers, Loan numbers
- Last updated
What happened
LoanCare is a mortgage servicer, which means it collects your monthly payment on behalf of your lender. Many borrowers have never chosen it. It's owned by Fidelity National Financial (FNF), which disclosed a cyberattack in a Form 8-K filing with the SEC in late November 2023. FNF said it identified the incident on November 19, contained it about a week later and restored operations by December 6.
LoanCare said it became aware of unauthorized access to its systems on or around November 19, 2023. On December 20 it filed a notice with the Maine Attorney General saying 1,316,938 people were affected, and it mailed letters starting December 20.
What was exposed
According to the notice, hackers accessed full names, physical addresses, Social Security numbers and loan numbers. LoanCare said it had not identified any fraudulent use of the information.
A Social Security number paired with a name and address is the core of an identity theft kit. The loan number adds something specific for scammers: they can pose as LoanCare or your lender, quote a real loan number and ask you to confirm a payment or a new wire address. Mortgage payment scams work because the numbers look right.
LoanCare's response
LoanCare offered 24 months of free identity monitoring through Kroll. The ransomware group ALPHV, also known as BlackCat, claimed the attack on FNF according to news coverage, but FNF has not confirmed that.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A freeze stops anyone from opening new credit in your name. It's free and takes a few minutes each at Equifax, Experian and TransUnion. Lift it when you apply for credit yourself.
- 2
Enroll in the Kroll monitoring in your letter
The letter has an enrollment code. Two years of monitoring is free and flags new credit accounts and other changes under your Social Security number.
- 3
Verify any message about your mortgage payment
If someone contacts you about a payment change, a new wire account or a late fee, call LoanCare or your lender on the number printed on your statement. Never use a number or link from the message.
- 4
Check your credit reports
Pull your free reports at annualcreditreport.com and look for accounts or inquiries you don't recognize.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up. It can't remove data that already leaked, so the steps above matter most.
Frequently asked
Was I affected by the LoanCare data breach?
LoanCare said 1,316,938 people were affected and mailed letters from December 20, 2023. If you have or had a mortgage serviced by LoanCare, look for the letter.
What was exposed?
Full name, physical address, Social Security number and loan number, according to LoanCare's notice.
Is this the same as the Fidelity National Financial breach?
LoanCare is a subsidiary of FNF, and the notice ties the access to the FNF cyberattack that was identified on November 19, 2023.
Should I change my password?
Passwords weren't listed as exposed. If you reuse your mortgage portal password elsewhere, change it anyway, but the credit freeze matters more.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
