HackingFinancial ServicesFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

MR. COOPER GROUP INC.

bd_b07179e304b6e55f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 31, 2023

Filed

Mar 26, 2024

To disclose

21 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

65%

Full breach record for MR. COOPER GROUP INC. →4 incidents on file

Mr. Cooper (Nationstar Mortgage LLC) disclosed a data breach occurring between October 30 and November 1, 2023, involving unauthorized access to systems containing personal information of approximately 47,818 Rhode Island residents. The incident involved the exfiltration of names, addresses, SSNs, dates of birth, and bank account numbers. Mr. Cooper shut down systems, engaged cybersecurity experts, and notified law enforcement. Affected individuals were offered 24 months of credit monitoring and fraud assistance.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 21 weeks / 147 days

Oct 30, 2023

Begins

Oct 31, 2023

Discovered

Mar 26, 2024

Filed

vs. sector median

+12 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

SEC 8-Kbd_eb26991231ea68882023-12-15 · +102dVerified
Hawaii State AGbd_834e3ffcf5af1c482023-12-05 · +112dVerified
SEC 8-Kbd_c2d404959f98c3892023-11-09 · +138dVerified
SEC 8-Kbd_d32ed619bafc52c52023-11-02 · +145dCandidate

Name: NATIONSTAR MORTGAGE LLC
norm: nationstar mortgage

Name: MR. COOPER GROUP INC.
norm: mr cooper
Industry: Financial Servicesllm

Discovered: Oct 31, 2023
Breach occurred: Oct 30, 2023 – Nov 1, 2023
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Dec 31, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Data elements: Date of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: contacted law enforcement
Initial access: valid_credentials

During the incident: Initiated response protocols
Launched an investigation with the assistance of cybersecurity experts
Contacted law enforcement
Shut down our systems to contain the incident
Locking down our systems
Changing account passwords
Restoring our systems
Changes made: Monitoring the dark web
Enhancing the security of our systems
Providing you with access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing you with proactive fraud assistance
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(147 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 2 states

View merged incident ↗

SEC 8-KNov 2 · first

SEC 8-K+7d

Hawaii State AG+33d

SEC 8-K+43d

Delaware State AG+145d · this page

Pattern: first filing Nov 2, last Mar 26 (DE) — a 145-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2024/04/MrCooperIndividualNoticeProofRedacted.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 26, 2024
Raw hash: 8ed91e84c65ff7d3df6d69a69e1a79b7ab51c827cbfa78d94c72c2843cfebb4d

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityNATIONSTAR MORTGAGE LLC

Victim entityMR. COOPER GROUP INC.

Incidentdiscovered Oct 31, 2023

Stated responseInitiated response protocols

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov