MyFHA myfha.net MyFHA data breach: what happened and what to do
MyFHA, a home financing website, was breached around February 2015. Have I Been Pwned lists 972,629 accounts with contact details, credit status, income, loan information and passwords.
View all 13,115 breaches- Breach date
- 18 Feb 2015
- Affected
- 972,629
- Data exposed
- Credit status information, Email addresses, Income levels, IP addresses, Loan information, Names, Passwords, Personal descriptions, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
MyFHA is a home financing website. In approximately February 2015 it suffered a data breach that exposed the personal information of nearly 1 million people. The data came to light in 2018, when multiple parties contacted Have I Been Pwned with it. Have I Been Pwned lists 972,629 accounts.
What was exposed
The data was unusually personal. HIBP lists credit status information, email addresses, income levels, IP addresses, loan information, names, passwords, personal descriptions and physical addresses. Per HIBP, the notes on personal circumstances often referred to legal issues, divorces and health conditions.
What the company did
MyFHA was alerted in mid-July 2018. It acknowledged the legitimacy of the breach and then took the site offline. The sources used for this page don't say how the attackers got in.
What it means for you
Financial details attached to a name and home address are what scammers use to target people who are looking for a mortgage. They know roughly how much you earn, what you wanted to borrow and how your credit looked, so a fake loan offer or "refinancing" call can sound well informed.
The personal notes add another risk. Details about a divorce or a health problem can be used for pressure or blackmail-style scams, so treat any message that mentions them as a red flag.
The data is also several years old, so addresses and phone numbers may have changed, but the email address and password may not have.
What to do if you were in it
- 1
Be suspicious of loan and refinancing offers
If a call, text or email offers a mortgage or refinancing and knows details about your finances, don't engage. Contact your lender using a number from its official site.
- 2
Change your password, and anywhere you reused it
Set a new, unique password on MyFHA and any account that used the same password. If you used the same password on other accounts, change those too. A password manager makes unique passwords painless.
- 3
Check your credit reports and consider a freeze
Get your free reports from Equifax, Experian and TransUnion. A credit freeze is free and blocks new accounts opened in your name.
- 4
Check whether your email is in this and other breaches
Run a free Serus scan. It checks your email and phone number against breach databases and the dark web, and Serus alerts you if they show up in a new one.
Frequently asked
Was I affected by the MyFHA breach?
Have I Been Pwned lists 972,629 accounts. Search your email on its site, or run a free Serus scan.
What was exposed in the MyFHA breach?
HIBP lists credit status information, income levels, loan information, names, physical addresses, email addresses, IP addresses and passwords.
Should I change my password?
Yes, anywhere you used the password you had on MyFHA.
Is MyFHA still online?
HIBP says MyFHA took the site offline after acknowledging the breach.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
