Towne Mortgage Company, a full-service mortgage lender, suffered a ransomware attack by the BlackByte ransomware group, leading to a major data breach. Unauthorized access to the company’s network was detected on June 7, 2025, and a forensic investigation later confirmed that customer data files were copied from its systems. The breach was publicly disclosed on November 14, 2025, after BlackByte published sample stolen data on its dark web portal on July 30, 2025, heightening risks of identity theft and fraud.The compromised data included personal information of customers, exposing them to potential financial and reputational harm. In response, Towne Mortgage offered 24-month credit monitoring, fraud alerts, and security freeze guidance to affected individuals. The attack underscores the severe consequences of ransomware-driven breaches, where data exfiltration and extortion compound the damage beyond mere encryption.The incident highlights the criminal intent behind the attack, with the threat actor actively leaking sensitive data to pressure the company. Customers were advised to monitor financial accounts and credit reports for unauthorized activity, reflecting the long-term risks posed by such breaches.
Source: https://www.claimdepot.com/data-breach/towne-mortgage-2025
AmeriCU Mortgage cybersecurity rating report: https://www.rankiteo.com/company/americu-mortgage
"id": "AME1192511111525",
"linkid": "americu-mortgage",
"type": "Ransomware",
"date": "6/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'mortgage lending',
'name': 'Towne Mortgage Company',
'type': 'private company'}],
'customer_advisories': ['enroll in 24-month credit monitoring via Cyberscout',
'place fraud alerts/security freezes with credit '
'bureaus',
'monitor financial accounts for unauthorized '
'activity'],
'data_breach': {'data_encryption': True,
'data_exfiltration': True,
'personally_identifiable_information': True,
'sensitivity_of_data': 'high (potential for identity '
'theft/fraud)',
'type_of_data_compromised': ['personal information']},
'date_detected': '2025-06-07',
'date_publicly_disclosed': '2025-11-14',
'description': 'Full-service mortgage lender Towne Mortgage Company disclosed '
'a major data breach following a ransomware attack by the '
'BlackByte group. Unauthorized access was detected on June 7, '
'2025, with sample customer data published on the dark web on '
'July 30, 2025. The breach was publicly disclosed on November '
'14, 2025, after a forensic investigation confirmed that files '
'containing customer data may have been copied. Affected '
'individuals were notified and offered 24-month credit '
'monitoring and fraud assistance services.',
'impact': {'brand_reputation_impact': 'high (potential identity theft and '
'fraud risks)',
'data_compromised': True,
'identity_theft_risk': 'high'},
'initial_access_broker': {'data_sold_on_dark_web': True,
'high_value_targets': ['customer personal data']},
'investigation_status': 'completed (forensic investigation and manual review '
'conducted)',
'motivation': ['financial gain', 'data theft'],
'post_incident_analysis': {'corrective_actions': ['credit monitoring services '
'for affected individuals',
'fraud prevention '
'guidance']},
'ransomware': {'data_encryption': True,
'data_exfiltration': True,
'ransomware_strain': 'BlackByte'},
'regulatory_compliance': {'regulatory_notifications': ['Massachusetts '
'Attorney General']},
'response': {'communication_strategy': ['notification letters to affected '
'individuals',
'public disclosure to Massachusetts '
'Attorney General',
'advisories on credit monitoring '
'enrollment (90-day window)',
'guidance on fraud alerts/security '
'freezes with Equifax, Experian, and '
'TransUnion'],
'incident_response_plan_activated': True,
'recovery_measures': ['notification to affected individuals',
'24-month credit monitoring (Cyberscout)',
'single bureau credit reports',
'credit score services',
'fraud assistance and guidance'],
'remediation_measures': ['forensic investigation',
'manual review of compromised data'],
'third_party_assistance': ['Cyberscout (TransUnion)']},
'stakeholder_advisories': ['credit monitoring enrollment (within 90 days)',
'fraud alert/security freeze guidance',
'regular review of financial statements and credit '
'reports'],
'threat_actor': 'BlackByte ransomware group',
'title': 'Towne Mortgage Company Ransomware Attack and Data Breach',
'type': ['ransomware', 'data breach']}