HackingCustomer Data InvolvedDelayed DiscoveryIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Impac Mortgage Holdings, Inc.
bd_450c61a65f466a37 · schema v1 · pii pii-v1
Full breach record for Impac Mortgage Holdings, Inc. →Impac Mortgage Holdings, Inc. notified the California Attorney General of unauthorized access to its systems occurring between February 21, 2024, and March 20, 2024. The company identified indications of potential unauthorized access on March 20, 2024. The incident involved names and Social Security numbers. Impac secured systems, reported to federal law enforcement, and is offering credit monitoring services. No specific count of affected individuals was disclosed in the notice.
California clockDiscovered Mar 20, 2024 → Notified Mar 27, 2026737d ✗ CA 60-day late25 months discovery → filing
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_12967a53eefe1d12Vermont State AGfiled 2026-04-17Verified
- bd_d1441c9d42c18c92New Hampshire State AGfiled 2026-04-17Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-621934
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 17, 2026
- Raw hash
- adb7b1ef7aff5f978191a2ceb1ba1f2372dbe361b8a6f242860b99805fb42f00
Reporting entity
- Name
- Impac Mortgage Holdings, Inc.norm: impac mortgage
- Domain
- impaccompanies.com
Victim entity
- Name
- Impac Mortgage Holdings, Inc.norm: impac mortgage
- Domain
- impaccompanies.com
Incident
- Discovered
- Mar 20, 2024
- Materiality determined
- —
- Notification sent
- Mar 27, 2026
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unknown
- Threat actor
- External
- Regulator citations
- Reported this event to federal law enforcement
Compliance
- Time to disclose
- 25 months(758 days from discovery to filing)
- Compliance flags
- CA 60-day late · 737dCA AG copy >15d · 21dLeak >180d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Mar 20, 2024→ Notified: Mar 27, 2026737d 60 days (analyst band, pre-2026 discoveries) CA 60-day late California Consumers notified: Mar 27, 2026→ AG copy submitted: Apr 17, 202621d 15 calendar days CA AG copy >15d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.