PennyMac Discloses Data Breach Affecting Nearly 4,000 Individuals
Private National Mortgage Acceptance Company LLC, a subsidiary of mortgage lender PennyMac, reported a data breach impacting its Group Health Plan, exposing the protected health information (PHI) of 3,972 individuals in the U.S. The incident was disclosed to the U.S. Department of Health and Human Services (HHS) on June 9, 2026.
PennyMac, which operates through entities like PennyMac Loan Services LLC, serves over 4 million customers nationwide. While the breach involved PHI under the Group Health Plan, the company has not publicly specified the exact types of data compromised.
Affected individuals have been advised to contact PennyMac for further details and potential assistance. The breach underscores ongoing risks to sensitive health data within corporate benefit plans.
Source: https://www.claimdepot.com/data-breach/pennymac-2026
PENNYMAC cybersecurity rating report: https://www.rankiteo.com/company/pennymac
"id": "PEN1783968271",
"linkid": "pennymac",
"type": "Breach",
"date": "6/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '3,972',
'industry': 'Mortgage Lending',
'location': 'U.S.',
'name': 'Private National Mortgage Acceptance Company '
'LLC (PennyMac)',
'size': 'Large (serves over 4 million customers)',
'type': 'Subsidiary'}],
'customer_advisories': 'Affected individuals advised to contact PennyMac for '
'further details and potential assistance',
'data_breach': {'number_of_records_exposed': '3,972',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': 'Protected Health Information '
'(PHI)'},
'date_publicly_disclosed': '2026-06-09',
'description': 'Private National Mortgage Acceptance Company LLC, a '
'subsidiary of mortgage lender PennyMac, reported a data '
'breach impacting its Group Health Plan, exposing the '
'protected health information (PHI) of 3,972 individuals in '
'the U.S.',
'impact': {'data_compromised': 'Protected Health Information (PHI)',
'identity_theft_risk': 'High'},
'references': [{'source': 'U.S. Department of Health and Human Services '
'(HHS)'}],
'regulatory_compliance': {'regulations_violated': 'HIPAA (assumed)',
'regulatory_notifications': 'Disclosed to U.S. '
'Department of Health '
'and Human Services '
'(HHS)'},
'response': {'communication_strategy': 'Affected individuals advised to '
'contact PennyMac for details'},
'title': 'PennyMac Discloses Data Breach Affecting Nearly 4,000 Individuals',
'type': 'Data Breach'}