A ransomware group claims it posted the stolen data on the dark web
A class action lawsuit alleges The Money Store left borrower data exposed after a cyberattack.
The suit, filed in US District Court in New Jersey on October 21, 2026, claims MLD Mortgage, Inc. - the lender that operates as The Money Store - failed to protect sensitive personal information it collected from home loan customers. According to the filing, a cyberattack that began on or around September 8, 2026, allegedly gave criminals access to borrower names, Social Security numbers, dates of birth, driver's license details, taxpayer identification numbers, and financial information.
The plaintiff, an Illinois borrower who says he used The Money Store's home loan services in 2025, alleges he did not receive a breach notice until October 15, 2026. That was 37 days after the breach allegedly started.
That gap is central to the case. The lawsuit claims the delay stripped borrowers of "the opportunity to try and mitigate their injuries in a timely manner." Put simply, the suit says people whose data was allegedly stolen had no way to know they should freeze their credit or watch their accounts - because the lender had not told them anything was wrong.
Storm claims and the dark web
The filing points to a ransomware monitoring group that attributed the attack to a cybercriminal operation known as "Storm." According to the complaint, Storm runs a data leak site on the dark web where it publishes stolen data to pressure organizations that have been breached. On or around September 21, 2026, Storm allegedly posted a claim on that site saying it had hacked The Money Store.
The lawsuit says this "indicates that Storm hacked Defendant's computer network, stole the sensitive PII contained therein, and published the stolen PII on the Dark Web." That language comes from the filing itself - no court has assessed whether any of it is accurate.
The plaintiff alleges the breach has already had real-world consequences for him. According to the suit, he experienced "a spike in spam and scam emails, text messages, and phone calls" after the breach. He also says he has been receiving physical spam letters at the property connected to his home loan application with the lender.
Where the compliance allegations stack up
The complaint gets specific about what it says went wrong. It alleges The Money Store failed to meet the minimum standards of both the NIST Cybersecurity Framework Version 2.0 and the Center for Internet Security's Critical Security Controls - two widely recognized cybersecurity benchmarks. The filing lists 18 specific NIST controls it says were not met, covering areas like access management, data protection, incident response, and network monitoring.
Then there is the Gramm-Leach-Bliley Act - the federal law that requires financial institutions, including mortgage lenders, to safeguard consumer data. The complaint alleges The Money Store violated both the GLBA's Privacy Rule and its Safeguards Rule. Among the claims: the lender allegedly failed to maintain a written information security program, failed to assess foreseeable risks to consumer data, and failed to send annual privacy notices to consumers whose information it kept on file after their loans closed.
The filing also quotes The Money Store's own privacy policy, which states: "To protect your personal information from unauthorized access and use, we use security measures that comply with federal law." The suit alleges the breach itself shows that promise was not kept.
What the suit is chasing
The filing brings eight separate legal claims. In plain terms, they boil down to allegations that The Money Store was careless with borrower data, broke its own promises to keep that data safe, violated federal data protection laws, and invaded borrowers' privacy by letting their information fall into the wrong hands. The suit also asks the court to formally declare that the lender's security practices were inadequate and to order improvements.
The proposed class covers all US residents whose personal data was allegedly compromised in the breach. The complaint says the exact number of affected borrowers is unknown but alleges it exceeds 100. The amount in dispute is alleged to exceed $5 million.
For mortgage lenders, the allegations are a sharp reminder: the data collected through every loan application - Social Security numbers, tax IDs, financial records - puts originators squarely in the crosshairs of cybercriminals. And how quickly a lender tells borrowers about a breach may matter just as much as the breach itself.
None of the allegations in the lawsuit have been proven, and no court has ruled on any of the claims.
