LoanDepot, a US lender hit by a cyberattack that affected internal systems and caused disruption for customers.
The attack reportedly occurred over the weekend, with the company officially disclosing the attack in an 8-K filing with the U.S. Securities and Exchange Commission.
LoanDepot said that upon detecting unauthorized activity, it promptly took steps to contain and respond to the incident, ticking off a typical incident response list: launching an investigation, hiring third-party cybersecurity experts and notifying applicable regulators and law enforcement.
The investigation is ongoing, and at present, the company has determined that the unauthorized third-party activity included access to certain company systems and the encryption of data. In response, it has shut down certain systems and continues to implement measures to secure its business operations, bring systems back online, and respond to the incident. The investigation will be continued, and the impact will be determined.
Although it didn’t disclose the form of attack, a hint came where it mentioned “the encryption of data.” If data was encrypted in the attack, that makes the attack almost certainly ransomware. No ransomware gang has yet claimed responsibility for the attack.
If data has been stolen, it will be a potential treasure trove of data, including personally identifiable information. As of April last year, the company was the third-largest mortgage lender in the U.S., providing mortgages to millions of customers.
The timing of the attack also has potential legal ramifications, given new disclosure regulations that came into force last month.
The SEC requirements might apply given that it’s a public company, Pandey added. “However, the challenge is whether this is a ‘material’ incident based on the SEC definition,” he said. “If so, they will have to disclose this in their next 8K report and document their security processes in their 10K at the end of the year.”
