Major Data Breach at SitusAMC

SitusAMC — one of the largest U.S. providers of real-estate, mortgage, collateral management and loan diligence services — has confirmed a significant data breach following unauthorized access to its internal systems.

SitusAMC plays a central role in mortgage servicing, due diligence, collateral assessment, and asset management across both residential and commercial markets. This means the breach has the potential to impact a wide network of banks, lenders, servicers, and institutional clients.

Photo: https://pl.freepik.com/

According to the company’s official disclosures:

➡️ Certain internal systems were compromised by an unauthorized third party.

➡️ No encrypting malware or ransomware was used — making this a pure data exfiltration attack, not a disruption attack.

➡️ The company engaged leading third-party forensic experts and notified federal law enforcement.

➡️ The intrusion has been contained, and all systems remain operational.

➡️ The fact that no encryption was involved strongly suggests a targeted exfiltration incident, likely motivated by theft of high-value financial and legal documents.

SitusAMC acknowledges that both corporate data and client-related records were accessed.

➡️ The affected information includes:

➡️ Corporate files such as accounting documents, invoices, legal contracts.

➡️ Residential Collateral & Asset Management system files.

➡️ Loan file due diligence records tied to the residential loan process.

➡️ Other business-related data from multiple divisions.

This breach demonstrates once again how supply chain dependencies can impact entire industries. In mortgage and real-estate ecosystems, third party providers like SitusAMC handle enormous volumes of client documentation, accounting files, and highly sensitive loan data.

For banks, lenders, loan servicers, and asset managers, this is a reminder that supply-chain cybersecurity and vendor risk management are as critical as internal controls.

This incident reinforces the need to:

➡️ continuously monitor third-party posture,

➡️ conduct periodic reassessments,

➡️ verify SOC1, SOC2 reports,

➡️ verify data minimization practices.

Even in highly regulated industries like finance, risk is never fully eliminated — only managed.

Link 1

Link 2

Author: Sebastian Burgemejster