HackingIdentity (basic)Government IDFinancial accountMediumContained

PLAZA HOME MORTGAGE, INC.

bd_363e67a782dce007 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 17, 2026

Filed

May 29, 2026

To disclose

—

Affected

Not disclosed

Linked

13 records

Confidence

66%

Full breach record for PLAZA HOME MORTGAGE, INC. →

Plaza Home Mortgage, Inc. notified Nebraska AG that unauthorized access occurred on or around February 17, 2026, involving one employee's computer. Threat actors accessed personal information including names, SSNs, DOBs, driver's licenses, and mortgage loan data. The company removed the threat actor, implemented security measures, and offered 12 months of credit monitoring via CyEx. Notices were sent May 19, 2026.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 17, 2026

Begins

Feb 17, 2026

Discovered

May 29, 2026

Filed

This filing is one of 13 records about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Indiana State AGbd_08868d749599b3232026-05-29Verified by operator
Illinois State AGbd_442e170726b496c72026-06-01 · +3dVerified
California State AGbd_2c33570cae2916332026-06-05 · +7dVerified
Oregon State AGbd_a8339956aa83bb852026-06-05 · +7dVerified

Show 6 more filings ↓up to 19d gap

Maine State AGbd_c1a623e388a3a78f2026-06-05 · +7dCandidate
Washington State AGbd_e5229764cc84dd6a2026-06-05 · +7dCandidate
Montana State AGbd_40da43091fd16ae32026-06-08 · +10dVerified
Texas State AGbd_87ba392247de474e2026-06-09 · +11dVerified
New Hampshire State AGbd_452429ca9a0fc4b82026-06-11 · +13dVerified by operator
Massachusetts State AGbd_632f658ed72eb6432026-06-17 · +19dVerified

Showing first 10 of 12 linked disclosures.

Name: PLAZA HOME MORTGAGE, INC.
norm: plaza home mortgage
Domain: plazahomemortgage.com

Name: PLAZA HOME MORTGAGE, INC.
norm: plaza home mortgage
Domain: plazahomemortgage.com

Discovered: Feb 17, 2026
Breach occurred: Feb 17, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 19, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Took immediate actions to remove the threat actor from our systems
Implemented additional organizational, technical and administrative security measures
Retained CyEx, a specialist in identity theft prevention to provide you with 12 months of credit monitoring services and identity theft services
Changes made: Implemented additional organizational, technical and administrative security measures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 11 states

View merged incident ↗

Indiana State AGMay 29 · first

Nebraska State AGMay 29 · first · this page

Illinois State AG+3d

California State AG+7d

Oregon State AG+7d

Maine State AG+7d

Washington State AG+7d

Montana State AG+10d

Texas State AG+11d

New Hampshire State AG+13d

Massachusetts State AG+19d

Pattern: first filing May 29 (IN), last Jun 17 (MA) — a 19-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 12 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/02b5abfa-ae61-499a-8439-fff0cb3068ce.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 29, 2026
Raw hash: c045b17d5b4644128e8b779bf3fd04e797ec0d6f4184a55684d8d38391a859be

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityPLAZA HOME MORTGAGE, INC.

Victim entityPLAZA HOME MORTGAGE, INC.

Incidentdiscovered Feb 17, 2026

Stated responseTook immediate actions to remove the threat actor from our systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov