LoanDepot Ransomware Attack

On January 8, 2024, LoanDepot suffered a ransomware attack that encrypted internal systems and forced the immediate shutdown of all loan origination and processing systems. The attack occurred at a particularly damaging time as interest rates were fluctuating and the mortgage market was already under pressure. Threat actors exfiltrated approximately 16.9 million customer records containing highly sensitive data including names, addresses, Social Security numbers, loan account details, financial transaction records, property addresses, and escrow account information. The company was unable to process loan payments, fund new loans, or handle customer inquiries for over a week. LoanDepot faced multiple class-action lawsuits alleging negligence in data protection.

LoanDepot is one of the largest non-bank mortgage lenders in the United States, originating billions of dollars in home loans annually. The company operates primarily online and through a network of loan officers nationwide.

The ransomware attack encrypted LoanDepot's core systems including loan origination platforms, customer databases, and payment processing systems. The attackers gained initial access through a compromised employee account with elevated privileges, using phishing credentials. They deployed ransomware across the network after exfiltrating data over a period of days.

Unknown ransomware group. The attack showed characteristics of a sophisticated operation with exfiltration before encryption, suggesting an established ransomware affiliate operation.

Attribution sources

• BleepingComputer
• Media reports

Countries affected

• United States

Data types

• Full names
• Social Security numbers
• Addresses
• Loan account numbers
• Financial transaction records
• Property addresses
• Escrow account information
• Dates of birth

LoanDepot reported material financial impact including loss of loan origination revenue during shutdown, IT remediation costs, legal fees, and potential regulatory fines. Estimated total impact exceeding $150 million.

Public reaction

Significant customer anger as homeowners were unable to make payments or close loans. Many reported their Social Security numbers were compromised.

Political impact

Congressional scrutiny of non-bank mortgage lender cybersecurity preparedness. CFPB opened investigation into data protection practices.

Multiple class-action lawsuits consolidated in federal court. Regulatory investigations by CFPB and state authorities ongoing.

Civil lawsuits

• Consolidated class-action: In re LoanDepot Data Breach Litigation

Policy changes

• Calls for enhanced cybersecurity requirements for non-bank mortgage lenders

Security improvements

• Complete IT infrastructure overhaul
• Enhanced endpoint detection and response deployment
• Improved backup and disaster recovery systems

Significance

One of the most disruptive ransomware attacks on a financial institution, demonstrating the operational fragility of digital-first mortgage lending.

Legacy

LoanDepot became a cautionary tale for the financial services industry about the catastrophic operational impact of ransomware on digital lending platforms.

Publishing organisations

• BleepingComputer

Systems restored over several weeks. Customer notification completed. Credit monitoring offered. Investigation ongoing.

References

1. [1]BleepingComputer: LoanDepot ransomware attack impacts 16.9M
2. [2]Reuters: LoanDepot cyberattack
3. [3]SEC Filing: LoanDepot 8-K disclosure