Impac Mortgage Holdings Reports Two-Year-Old Data Breach Affecting Over 19,000 Individuals
Learn More
Impac Mortgage Holdings, a mortgage lender based in Irvine, California, reports a data breach on April 17, 2026. The company detected the breach on March 20, 2024, it waited two years to finish its internal review and start notifying victims in late March 2026.
The attacker stayed in the network for about four weeks, from February 21, 2024, to March 20, 2024. During this time, the actor accessed and potentially copied files and folders containing sensitive information. Impac Mortgage Holdings worked with outside security experts to check the scope. The compromised data includes:
- Full names
- Social Security numbers
The number of affected individuals is 19,253. The company has not disclosed the nature of the attack or if the attackers asked for a ransom.
Impac Mortgage Holdings notified federal law enforcement and is offering 12 months of free credit monitoring to those affected. The company also said it added new security rules and administrative safeguards to its network to prevent similar events.
