Loading story…
SitusAMC, a major third-party vendor providing mortgage processing services to hundreds of financial institutions, suffered a significant data breach discovered on November 12 and confirmed on November 22. The breach has prompted leading US banks, including JPMorgan Chase, Citi, and Morgan Stanley, to assess the potential exposure of sensitive customer data, particularly information related to residential loan mortgages. SitusAMC has acknowledged that both corporate records and certain client customer data may have been compromised, though the full scope and impact remain under investigation.
The FBI is actively involved in the investigation and has stated that, so far, there is no evidence of operational impact on banking services. The incident highlights the increasing cyber risks associated with third-party vendors in the financial sector, with vendor-related breaches reportedly up 15% year-over-year. SitusAMC’s role in handling extensive personal and financial information for major lenders underscores the potential scale and seriousness of the breach as banks and regulators continue to evaluate the fallout.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
By November 24, reporting identified JPMorgan Chase, Citi, and Morgan Stanley among institutions assessing possible fallout from the vendor breach. No operational disruption to banking services was reported, but the extent of affected institutions and customers remained under investigation.
Following confirmation of the breach, SitusAMC reset credentials, disabled remote access tools, updated firewall rules, and strengthened security settings. The company also engaged external experts and began cooperating with the FBI, which confirmed an active investigation while services remained operational.
On November 22, SitusAMC broadened its communications and informed all customers about the incident. The company said the full scope of the stolen data was still under investigation.
On November 16, SitusAMC began notifying customers it believed were potentially affected by the breach. Major financial institutions were later reported among those alerted.
SitusAMC confirmed the security incident in mid-November after discovering unauthorized access to its environment. Reporting indicates the breach was discovered on November 12 and confirmed by November 15.
Earlier in November 2025, attackers breached SitusAMC's systems and exfiltrated confidential client information. The stolen data included accounting records, legal agreements, and potentially some customer data tied to client institutions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
6 references tracked. Mallory keeps watching after this page renders.
computerweekly.com
Open sourcethecyberthrone.in
Open sourcego.theregister.com
Open sourcecsoonline.com
Open sourcebleepingcomputer.com
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
JPMorgan Chase disclosed that attackers breached its network and accessed customer contact information tied to **76 million households** and **7 million small businesses**, making it one of the largest publicly reported compromises of a U.S. financial institution. The bank said the stolen data included names, email addresses, phone numbers, and physical addresses, while **account numbers, passwords, Social Security numbers, dates of birth, and debit or credit card data were not exposed**. The intrusion reportedly began in June, went undetected for weeks, and involved access to more than 90 servers before the company contained it and notified customers using services such as Chase.com and its mobile banking platforms. U.S. investigators examined possible Russian links early in the case, and later authorities charged **Gery Shalon, Joshua Samuel Aaron, and Ziv Orenstein** in connection with a broader hacking campaign tied to the JPMorgan intrusion and other attacks on financial firms and publishers. Prosecutors described the operation as part of a multi-year scheme that stole data from more than 100 million customers across victims, while security experts warned that the JPMorgan data set remained highly valuable for phishing and fraud because it provided a large, current list of bank customers and small businesses. JPMorgan said it had not seen unusual fraud directly tied to the breach and urged customers to be wary of unsolicited emails and text messages.
Jun 29, 2026
Marquis Software Solutions, a provider of marketing and compliance software to over 700 banks and credit unions, experienced a significant data breach after ransomware attackers exploited a vulnerability in its SonicWall firewall. The breach, detected on August 14, allowed attackers to access files containing sensitive information stored by Marquis on behalf of its financial institution clients, potentially exposing the personal data of at least 250,000 individuals. The compromised data may include names, addresses, phone numbers, dates of birth, Social Security numbers, tax identification numbers, and financial account information. Marquis Software stated that the incident was limited to its own environment, but the breach has affected multiple financial institutions whose customer data was managed by the vendor. The company is working with digital forensic investigators to assess the full scope of the breach and has notified affected parties accordingly.
Jun 29, 2026
Several significant data leaks and ransomware incidents have surfaced, affecting a range of organizations including Banco Vimenca, WIRED subscribers, Mexico’s Tax Administration Service (SAT), and New Zealand’s Neighbourly platform. Threat actors have claimed responsibility for exposing sensitive data such as government financial records, large-scale subscriber information, and user communications, with some incidents linked to ransomware groups. While the authenticity of these dark web postings remains unverified, the breadth of affected entities highlights ongoing risks to both financial institutions and government agencies from cybercriminal activity. In the United States, two banks—Artisans' Bank and VeraBank—have notified thousands of customers that their personal information was compromised in a ransomware attack on Marquis Software, a vendor providing data analytics and communication services to financial institutions. The attack, traced to a vulnerability in a SonicWall firewall, resulted in the exposure of names and Social Security numbers, though the banks’ own systems were not directly breached. These incidents underscore the persistent threat posed by supply chain vulnerabilities and the importance of robust third-party risk management for organizations handling sensitive data.
Jun 29, 2026