Loan applications, Social Security numbers, mortgage docs - all allegedly stolen
A ransomware gang called Storm allegedly broke into the systems of MLD Mortgage Inc., the privately held lender that operates as The Money Store, and walked away with borrower data - Social Security numbers, loan applications, mortgage documents, the lot.
Two class action lawsuits landed on October 9, 2026, in the US District Court for the District of New Jersey, where The Money Store is headquartered in Florham Park. The suits were filed the same day by separate plaintiffs with different law firms - a pattern that typically signals a race to lead the class.
Robert Turner, a Washington state resident described in his filing as a former client of the lender, brought the first suit through Milberg, PLLC. Angel Chavez, a resident of San Pedro, California, filed the second through Kopelowitz Ostrow P.A. Both seek to represent a nationwide class of people whose personal information was allegedly compromised.
According to both filings, Storm added The Money Store to its public list of breach victims on or about September 22, 2026. The lawsuits describe Storm as responsible for "numerous data breaches since August 2026" and known for "double extortion tactics" - encrypting a company's data while threatening to publish stolen information unless a ransom is paid.
What allegedly walked out the door is the kind of data that keeps compliance teams up at night. Both filings claim the compromised information includes "full names, contact information, Social Security numbers, financial account information, loan application details, income and employment records, property and mortgage documentation, and credit history information." In plain terms, that is close to the full contents of a mortgage origination file.
Neither filing indicates that The Money Store had issued any public disclosure about the breach as of the date the lawsuits were filed. According to both suits, the lender "admits that information in its system was accessed by unauthorized individuals, though it provided little information regarding how the Data Breach occurred."
Both cases bring four claims: negligence, negligence per se - essentially arguing the lender broke federal consumer protection rules by failing to safeguard data - unjust enrichment, and breach of implied contract. The central argument is straightforward: The Money Store collected deeply sensitive personal and financial data from borrowers, had a duty to protect it, and allegedly failed to put reasonable cybersecurity in place. Both filings point to the lender's alleged failure to meet standards set by the NIST Cybersecurity Framework, the federal government's widely used blueprint for managing cyber risk.
Turner says he has experienced a "significant increase in spam communications" since the breach and purchased credit monitoring at his own expense. Both plaintiffs allege they have spent time reviewing financial statements and monitoring credit reports, and say they face ongoing risk of identity theft.
The filings also target the timing of the lender's response. Both lawsuits allege The Money Store failed to promptly notify affected borrowers, depriving them of "the earliest opportunity to guard" themselves against the breach's effects.
Each case puts the amount in controversy above $5 million. Both demand a jury trial.
The Money Store describes itself on its website as "a family-owned, privately held lender serving homebuyers and homeowners across the country."
For lenders and servicers sitting on years of borrower files, the dual filing is a pointed reminder: a ransomware incident does not end when the systems come back online. It starts a litigation clock, and the class action bar moves fast.
None of the allegations in either lawsuit have been tested, and no court has made any findings.
