---
title: "MLD Mortgage remote-management data incident"
description: "MLD Mortgage confirmed data acquisition through a service provider’s remote-management platform in September 2026."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-16"
canonical_url: "https://www.ally.security/incidents/mld-mortgage-remote-management-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/mld-mortgage-remote-management-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/mld-mortgage-remote-management-data-incident-2026/stix.json"
---

# MLD Mortgage remote-management data incident

MLD Mortgage, doing business as The Money Store, detected unusual activity on September 9, 2026. Its investigation found that an unauthorized party accessed and acquired information from part of its environment beginning around September 8.

Last modified Oct 16, 2026 · 1 source

## Summary

- **Environment:** Mortgage origination, underwriting and closing files
- **Operational impact:** Affected systems taken offline during containment
- **Financial impact:** No incident cost established in the reviewed evidence

## What happened

MLD Mortgage, doing business as [The Money Store](https://www.themoneystore.com/), detected unusual activity on September 9, 2026. Its investigation found that an unauthorized party accessed and acquired information from part of its environment beginning around September 8. [1](#source-1)

## Impact

Affected files included residential mortgage origination, underwriting and closing documents. The letter also says dependent names and Social Security numbers may have been involved where borrowers supplied supporting tax documents. [1](#source-1)

The public template leaves the recipient-specific data categories blank and gives no affected-person total.

## Timeline

### September 9, 2026 — Unusual activity detected

MLD detected activity in its IT environment. See the [source notice](https://oag.ca.gov/system/files/MLD%20-%20Sample%20Individual%20Notification%20Letter.pdf). [1](#source-1)

### October 15, 2026 — Notification letter dated

MLD issued the reviewed individual-notification letter. See the [source notice](https://oag.ca.gov/system/files/MLD%20-%20Sample%20Individual%20Notification%20Letter.pdf). [1](#source-1)

### October 16, 2026 — Briefing updated

This briefing was last reviewed and updated on October 16, 2026.

## Threat Group & Attack Vector

The unauthorized party entered through a remote monitoring and management platform used by a third-party service provider supporting MLD. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

MLD took affected systems offline, retained independent cybersecurity and forensic specialists, notified federal law enforcement, and strengthened monitoring, detection and access controls. [1](#source-1)

It offered identity-protection services to eligible recipients. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/mld-mortgage-remote-management-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### MLD Mortgage notice of data incident

official · MLD Mortgage Inc. · Oct 15, 2026

<https://oag.ca.gov/system/files/MLD%20-%20Sample%20Individual%20Notification%20Letter.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Unusual activity detected: MLD detected activity in its IT environment.
2. **Resulted In · 100% confidence · current**  
   Notification letter dated: MLD issued the reviewed individual-notification letter.
3. **Occurred At · 100% confidence · current**  
   Unusual activity detected: 2026-09-09
4. **Resulted In · 100% confidence · current**  
   MLD Mortgage remote-management data incident: Affected files included residential mortgage origination, underwriting and closing documents. The letter also says dependent names and Social Security numbers may have been involved where borrowers supplied supporting tax documents.
5. **Resulted In · 100% confidence · current**  
   MLD Mortgage remote-management data incident: MLD Mortgage, doing business as The Money Store, detected unusual activity on September 9, 2026. Its investigation found that an unauthorized party accessed and acquired information from part of its environment beginning around September 8.
6. **Occurred At · 100% confidence · current**  
   Notification letter dated: 2026-10-15
7. **Discovered At · 100% confidence · current**  
   MLD Mortgage remote-management data incident: 2026-09-09
8. **Affected Organization · 100% confidence · current**  
   MLD Mortgage remote-management data incident: MLD Mortgage Inc.
9. **Resulted In · 100% confidence · current**  
   MLD Mortgage remote-management data incident: The unauthorized party entered through a remote monitoring and management platform used by a third-party service provider supporting MLD.
10. **Resulted In · 100% confidence · current**  
   MLD Mortgage remote-management data incident: It offered identity-protection services to eligible recipients.
11. **Resulted In · 100% confidence · current**  
   MLD Mortgage remote-management data incident: Unusual activity detected
12. **Resulted In · 100% confidence · current**  
   MLD Mortgage remote-management data incident: MLD took affected systems offline, retained independent cybersecurity and forensic specialists, notified federal law enforcement, and strengthened monitoring, detection and access controls.
13. **Resulted In · 100% confidence · current**  
   MLD Mortgage remote-management data incident: Notification letter dated

</details>