Third servicer entangled in massive data breach litigation

The legal fallout from a massive data breach impacting over 4 million borrowers’ personally identifiable information just got bigger. 

A federal judge Monday ordered a class action lawsuit against Community Loan Servicing be folded into a larger, similar suit against two of its sister companies, according to court records. The consolidated complaints from borrowers in the U.S. District Court for the Southern District of Florida accuse the three servicers of negligence in failing to protect their PII, including Social Security numbers.

The merged lawsuit against Community, Lakeview Loan Servicing and Pingora Loan Servicing now includes 23 plaintiffs. The three firms are subsidiaries of Coral Gables, Florida-based Bayview Asset Management.

The legal action stems from a massive cyberattack which lasted 41 days last fall in which the PII of 4,023,108 customers combined was breached. The hack impacted 116,803 Community borrowers, 2,638,057 from Lakeview and 1,268,348 at Pingora, according to public disclosures.

San Francisco resident and homeowner John T. Johnson sued Community in late August in a California federal court, claiming unauthorized third parties have made fraudulent purchases on his behalf using his information stolen in the hack last fall. None of the lawsuits indicate the amount of damages sought by impacted borrowers.

A spokesperson for Bayview declined to comment Wednesday. Attorneys for both plaintiffs and the servicers and a representative for Bayview didn’t respond to requests for comment.

The culprit and method of attack have also yet to be disclosed by the servicers, and it’s unclear if the investigation remains ongoing. Bayview, in a statement last month, only acknowledged the data breaches at each servicer were part of the same cyberattack.

“To date, defendant has not provided any explanation as to how or why someone was able to gain access to Representative Plaintiff’s account and/or what steps it has and/or intends to take(n) to prevent further security failures,” wrote attorney Julia Deutsch of Oakland, California-based Cole & Van Note on behalf of Johnson.

Counsel for Lakeview and Pingora last month filed a motion to toss the consolidated class action before Community’s involvement, arguing plaintiffs didn’t allege harm as required by legal statutes. A Lakeview privacy policy also states the servicer doesn’t guarantee the security of PII, attorneys claimed.

All parties have already agreed to a case schedule extending to a trial date in 2024, with discovery and mediation deadlines through next year, according to court filings. 

The suit against Bayview subsidiaries is the largest among a slew of similar class action complaints against mortgage companies following their disclosures of large data breaches. Defendants in such suits include mortgage fintech Lower, depositories Flagstar Bank, KeyBank, Fulton Bank and Overby-Seawell Company, a firm which provides ongoing verification of residents’ property insurance coverage. None of those lawsuits have progressed beyond summons and defendant responses to the initial complaints.