AccidentalFinancial ServicesFinanceMisdeliveryEmployee Data InvolvedFinancial accountGovernment IDIdentity (basic)EmploymentMediumResolved

NATIONSTAR MORTGAGE LLC

bd_6b0a38567ef6db54 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 27, 2015

Filed

Aug 12, 2015

To disclose

16 days

Affected

Not disclosed

Confidence

65%

Full breach record for NATIONSTAR MORTGAGE LLC →11 incidents on file

Nationstar Mortgage LLC notified California residents that on July 27, 2015, an email containing a copy of a W2 form was inadvertently sent to an employee at Greenlight. The email was deleted from the recipient's mailbox. The breach exposed financial and identity information, including Social Security Numbers and income data. The company offered one year of identity protection services.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 27, 2015 → Notified Aug 11, 201515d ✓ CA 60-day OK16 days discovery → filing

Incident timeline

discovery → filing · 16 days

Jul 27, 2015

Begins

Jul 27, 2015

Discovered

Aug 12, 2015

Filed

vs. sector median

7 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: NATIONSTAR MORTGAGE LLC
norm: nationstar mortgage

Name: NATIONSTAR MORTGAGE LLC
norm: nationstar mortgage
Industry: Financial Servicesllm

Discovered: Jul 27, 2015
Breach occurred: Jul 27, 2015
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 11, 2015
Affected individuals: Not disclosed
Data types: Financial accountGovernment IDIdentity (basic)Employment
Attack vector: Unknown
Threat actor: Internal

During the incident: Deleted the email and its contents from the respective employee’s mailbox
Offering a complimentary one (1) year membership of Experian’s ProtectMyID Elite
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 days(16 days from discovery to filing)
Compliance flags: CA 60-day OK · 15d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 27, 2015
→ Notified: Aug 11, 2015
15d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 27, 2015 → Notified: Aug 11, 2015	15d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-57381
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 12, 2015
Raw hash: 706a393e68ca98d566337d6133bd30e791457f505e8c3a9c2cfdb0506f7b8ed3

Reporting entityNATIONSTAR MORTGAGE LLC

Victim entityNATIONSTAR MORTGAGE LLC

Incidentdiscovered Jul 27, 2015

Stated responseDeleted the email and its contents from the respective employee’s mailbox

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov