Mr. Cooper shuts down systems after cyberattack, blocking mortgage payments

Mr. Cooper Group, the Dallas-based mortgage servicer formerly known as Nationstar Mortgage, said an unauthorized third party gained access to some of its technology systems on October 31, 2023. The company detected the intrusion and shut down affected systems as a containment measure.

The shutdown took the online payment portal offline and stopped recurring mortgage payments from processing. Mr. Cooper is one of the largest servicers in the United States, handling loans for more than four million customers, so the outage reached a substantial share of the American mortgage market. The company told borrowers they would not be charged late fees, incur penalties or face negative credit reporting while systems were down, and it stood up a temporary informational site listing alternative ways to make one-time payments.

Mr. Cooper said it had notified law enforcement and engaged external cybersecurity specialists, and told investors it did not believe the incident would have a material adverse effect on its business or financial results. At the time it said it was still investigating whether customer data had been taken and would notify anyone affected.

In December 2023 the company filed breach notifications in Maine and California confirming that files taken between October 30 and November 1 contained names, addresses, phone numbers, Social Security numbers, dates of birth and bank account numbers for about 14.7 million current and former customers.