Academy Mortgage Corporation listed on ALPHV ransomware leak site

• Ransomware group: ALPHV
• Country: United States
• Sector: Financial Services
• Announcement date: July 26, 2023

Academy Mortgage Corporation targeted by ALPHV ransomware group

Academy Mortgage Corporation has been listed on the leak site of the ALPHV (BlackCat) ransomware group. The threat actor group claims to have exfiltrated sensitive customer and partner data from the financial institution. This announcement, made on July 26, 2023, follows a claimed attack date of May 14, 2023. While the group has posted the organization's name on their platform, the specific size of the data stolen and the total file count have not been disclosed by the attackers. Furthermore, no specific ransom demand has been publicly stated in the announcement.

The claims made by ALPHV

The ALPHV group alleges that it has successfully infiltrated the networks of Academy Mortgage Corporation. According to the group's claims, the attackers were able to copy the institution's confidential data from its internal systems. The threat actor has stated that the institution refused to meet their ransom demands, a situation that has led to the threat of public disclosure of the stolen information.

This tactic is a hallmark of double extortion, a common method used by modern ransomware groups. In a double extortion scheme, attackers do not merely encrypt a victim's files to disrupt operations; they also steal sensitive data before encryption. The threat of leaking this data on a public leak site provides the attackers with additional leverage to pressure the victim into paying the ransom. The current announcement suggests that significant customer financial information and personal data may be at risk due to this alleged breach.

Sensitive data and potential impact

The information provided by the threat actors includes screenshots that appear to contain highly sensitive documents. These documents reportedly include loan application forms, mortgage statements, internal audit reports, driver's licenses, and financial statements. Based on the claims made by the group, the following types of data may be affected:

• Customer personal data
• Financial data
• Driver's license information
• Credit scores
• Partner data

The exposure of such sensitive information can lead to severe consequences for the individuals involved. This incident may increase the risk of identity theft and fraud for the customers of Academy Mortgage Corporation. Furthermore, the sensitivity of the leaked data could heighten the likelihood of targeted phishing attacks against the affected individuals, as attackers can use the stolen details to craft highly convincing fraudulent communications.

Organization profile and industry implications

Academy Mortgage Corporation is a family-owned mortgage company based in the United States. Founded in 1988, the company operates as a direct lender providing home purchase and refinance loans. The institution maintains a significant presence across the country, operating with over 350 branch offices.

As a financial institution, the company may face complex obligations under various U.S. state-level data protection laws and federal regulations following such an incident. The publication of data on a leak site can create significant negative impacts on a corporation's reputation. For organizations operating within the financial sector, such incidents highlight the necessity of robust security measures and rapid response protocols. To mitigate risks, organizations often need to accelerate processes for notifying affected parties and conducting thorough reviews of their security measures to prevent future occurrences.