HackingFinancial ServicesFinanceStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)Financial accountMinorMediumContained

MLD MORTGAGE INC.

bd_0551d9a410178ebe · schema v1 · pii pii-v2

Severity

Medium

Discovered

Sep 9, 2026

Filed

Oct 15, 2026

To disclose

5 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

69%

Full breach record for MLD MORTGAGE INC. →2 incidents on file

MLD Mortgage Inc. dba The Money Store reported that an unauthorized third party accessed its environment via a remote monitoring and management platform used by a third-party service provider. The access occurred between September 8 and September 9, 2026, and was discovered on September 9, 2026. The incident involved residential mortgage loan files containing origination, underwriting, and closing documentation, potentially including Social Security numbers, names, addresses, and financial account information. Minor dependents' information may also have been involved. The company contained the incident, engaged forensic specialists, notified law enforcement, and is offering identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 5 weeks / 36 days

Sep 8, 2026

Begins

Sep 9, 2026

Discovered

Oct 15, 2026

Filed

vs. sector median

3 wks faster

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Texas State AGbd_be0b7cdc4645ab8e2026-10-16 · +1dVerified
Massachusetts State AGbd_f0f65908891f55e82026-10-01 · +14dVerified

Name: MLD MORTGAGE INC.
norm: mld mortgage

Name: MLD MORTGAGE INC.
norm: mld mortgage
Also named: MLD Mortgage Inc.dba oflegal entity
The Money Storedba oftrade name
Industry: Financial Servicesllm

Discovered: Sep 9, 2026
Breach occurred: Sep 8, 2026 – Sep 9, 2026
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Oct 15, 2026
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)Financial accountMinor
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified federal law enforcement
Third party: via third-party service provider
Initial access: supply_chain

During the incident: Took steps to secure the environment and contain the incident
Engaged independent cybersecurity specialists to assist with the investigation
Notified federal law enforcement
Took the affected systems offline
Enhanced monitoring, detection, and access controls
Offering identity theft protection services through IDX
Changes made: Enhanced monitoring, detection, and access controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGOct 1 · first

California State AG+14d · this page

Texas State AG+15d

Pattern: first filing Oct 1 (MA), last Oct 16 (TX) — a 15-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-631398
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 15, 2026
Raw hash: bfe0be13c22c5bc95905f9dbdb88206859f9950df3e74411d70e621ee65761e8

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMLD MORTGAGE INC.

Victim entityMLD MORTGAGE INC.

Incidentdiscovered Sep 9, 2026

Stated responseTook steps to secure the environment and contain the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov