The mortgage servicer Mr Cooper discovered a cyberattack on 31 October 2023, with unauthorised access reported between 30 October and 1 November. Files containing personal information were obtained covering almost 14.7 million people — reported as every current and former customer.
Reported categories are names, addresses, telephone numbers, social security numbers, dates of birth and bank account numbers. Multiple systems were shut down; customers attempting to pay their mortgages found the site unavailable and late fees were waived. The company raised its guidance for related fourth-quarter vendor expenses from $5–10 million to $25 million, including two years of identity protection.
Former Customers Have No Way Out
A person who paid off their mortgage in 2016, or refinanced away, has no account, no login and no ongoing relationship. They also had no ability to reduce their exposure, because the decision to retain their file was not theirs.
We have recorded this at 22-1024, where an insurer’s former customers were in the published set, at 22-0922 and at 22-0720. Retention past the relationship converts a closed transaction into a permanent liability held on somebody else’s behalf, and no consent obtained at signing covers it.
The Bank Account Number Is The Distinguishing Field
A mortgage servicer holds account and routing numbers because it debits them monthly. That is operationally necessary and it puts a directly actionable financial identifier in the same file as a social security number and a date of birth.
We have recorded identity documents as the unfixable category at 26-0726 and 22-0922. A bank account number sits alongside: changeable in principle, and in practice requiring the person to reorganise every automatic payment they have — which is why most will not.
People Could Not Pay Their Mortgage
The outage blocked the payment channel. Waiving late fees was the right response and it addresses the penalty, not the anxiety of an unpaid mortgage with no way to pay it.
This is availability harm to individuals rather than to an organisation, which we have recorded at 23-0625 for fuel payments and 22-1002 for postponed procedures. The count of 14.7 million describes the data loss. Nobody counted the people who spent a week unable to make a housing payment.
Built on contemporaneous reporting and the company’s notifications and filings. The 31 October 2023 discovery, the 30 October–1 November access window, the figure of almost 14.7 million affected described as every current and former customer, the reported data categories, the systems shutdown and waived late fees, and the revised $25 million expense guidance including two years of identity protection are as reported. No actor is named — none was authoritatively identified. No entry route was published and none is asserted. Graded high. Corrections: corrections@forensicpost.com.