Mortgage giant Mr. Cooper reports cyberattack as cause for outage, data breach of 14M

The mortgage lending and servicing company Mr. Cooper has acknowledged a cybersecurity breach that led to a significant system outage, affecting their IT infrastructure and online payment portal. Mr. Cooper, headquartered in Dallas, Texas, is a prominent entity in the U.S. mortgage sector, servicing loans amounting to $937 billion for over 4.1 million customers.

The incident, which occurred on October 31, prompted the company to initiate immediate lockdown protocols to secure data and systems. 

Following the cyberattack, customers were unable to access the website to make mortgage or loan payments and were informed of a technical outage via the company's website and customer communications.

Mr. Cooper has assured customers that they will not face any fees, penalties, or negative credit reporting due to payment issues caused by the incident. Despite the ongoing investigation into whether customer data was compromised, the company has stated that they do not expect the cybersecurity incident to have a material adverse impact on their business or financial outcomes.

The company has begun the process of system restoration and is actively working to bring services back online.

While the nature of the attack has not been explicitly confirmed as ransomware, the patterns suggest it could be, raising concerns about data theft and potential leverage for a ransom demand.

Customers are advised to be cautious, especially regarding phishing attempts and identity theft, as personal and financial information may be at risk.

Update - Mr. Cooper is offering customers alternate ways of paying off loans after a cyberattack on October 31. In updated instructions on Monday, the company provided customers with several different ways they can make payments, including by phone, mail service, Western Union and MoneyGram.

As of 10th of November Mr. Cooper informs customers that they believe customer data was exposed during the attack, but no details are provided.

As of 17th of December Mr. Cooper confirms that hackers accessed sensitive personal data of over 14.6 million customers of Mr. Cooper, including:

• names,
• addresses,
• dates of birth,
• phone numbers,
• Social Security numbers,
• bank account details.

Mr. Cooper estimates the incident's cost at a minimum of $25 million, significantly higher than earlier projections, to cover identity protection services for affected individuals.