HackingIdentity (basic)Government IDFinancial accountMediumContained

PLAZA HOME MORTGAGE, INC.

bd_40da43091fd16ae3 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Feb 17, 2026

Filed

Jun 8, 2026

To disclose

16 weeks

Affected

227state residents only

Linked

13 records

Confidence

70%

Full breach record for PLAZA HOME MORTGAGE, INC. →

Plaza Home Mortgage, Inc. notified Montana residents of a security incident occurring on or around February 17, 2026, involving unauthorized access to an employee's computer. The incident potentially exposed personal information including names, addresses, Social Security numbers, birth dates, driver's license numbers, and mortgage loan application data. The company launched an investigation, removed the threat actor, and implemented enhanced security measures. Affected individuals were offered 12 months of free credit monitoring and identity theft services through CyEx.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d16 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 16 weeks / 111 days

Feb 17, 2026

Begins

Feb 17, 2026

Discovered

Jun 8, 2026

Filed

This filing is one of 13 records about the same incident.View merged incident

A leak claim by silentransomgroup about this victim was first seen 101 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Texas State AGbd_87ba392247de474e2026-06-09 · +1dVerified
New Hampshire State AGbd_452429ca9a0fc4b82026-06-11 · +3dVerified by operator
California State AGbd_2c33570cae2916332026-06-05 · +3dVerified
Oregon State AGbd_a8339956aa83bb852026-06-05 · +3dVerified

Show 6 more filings ↓up to 10d gap

Maine State AGbd_c1a623e388a3a78f2026-06-05 · +3dCandidate
Washington State AGbd_e5229764cc84dd6a2026-06-05 · +3dCandidate
Illinois State AGbd_442e170726b496c72026-06-01 · +7dVerified
Massachusetts State AGbd_632f658ed72eb6432026-06-17 · +9dVerified
Indiana State AGbd_08868d749599b3232026-05-29 · +10dVerified by operator
Nebraska State AGbd_363e67a782dce0072026-05-29 · +10dVerified by operator

Showing first 10 of 12 linked disclosures.

Name: PLAZA HOME MORTGAGE, INC.
norm: plaza home mortgage
Domain: plazahomemortgage.com

Name: PLAZA HOME MORTGAGE, INC.
norm: plaza home mortgage
Domain: plazahomemortgage.com

Discovered: Feb 17, 2026
Breach occurred: Feb 17, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 19, 2026
Affected individuals: 227state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Retained CyEx, a specialist in identity theft prevention to provide 12 months of credit monitoring services and identity theft services
Launched an investigation
Removed the threat actor from our systems
Implemented additional organizational, technical and administrative security measures
Changes made: Implemented additional organizational, technical and administrative security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(111 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 11 states

View merged incident ↗

Indiana State AGMay 29 · first

Nebraska State AGMay 29 · first

Illinois State AG+3d

California State AG+7d

Oregon State AG+7d

Maine State AG+7d

Washington State AG+7d

Montana State AG+10d · this page

Texas State AG+11d

New Hampshire State AG+13d

Massachusetts State AG+19d

Pattern: first filing May 29 (IN), last Jun 17 (MA) — a 19-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 12 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2026/09/Consumer-notification-letter-39.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 8, 2026
Raw hash: 4fad97900d418b76b2ad54c9ef27832f98e57fa2817fb6ba35d1ebac9a80e583

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityPLAZA HOME MORTGAGE, INC.

Victim entityPLAZA HOME MORTGAGE, INC.

Incidentdiscovered Feb 17, 2026

Stated responseRetained CyEx, a specialist in identity theft prevention to provide 12 months of credit monitoring services and identity theft services

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancedojmt.gov