Nations Direct Mortgage notified 83,000 people of a December 2023 breach

Nations Direct Mortgage, a Nevada-based lender licensed to operate in 35 states, notified more than 83,000 people in March 2024 that their personal information had been exposed in a breach detected at the end of the previous year.

The company said it identified a cybersecurity incident on or about 30 December 2023 and opened an investigation with the help of third-party experts. That investigation concluded that an unauthorized third party had obtained access to, and potentially removed, data belonging to individuals across the country. The information involved names, addresses, Social Security numbers and Nations Direct loan numbers.

Nations Direct said it contained the incident shortly after discovery and notified law enforcement and government agencies. In its notification letters the company also said it had found no evidence that data was actually removed or exfiltrated, and no evidence of fraudulent use. Affected individuals were offered 24 months of identity monitoring through Kroll at no cost.

The lender filed breach notifications with the Office of the Maine Attorney General on 14 March 2024 and with regulators in California. In the weeks that followed, several plaintiffs' firms announced class action investigations into the incident.