theLender listed on termite ransomware leak site

• Ransomware group: termite
• Country: United States
• Sector: Financial Services
• Announcement date: September 22, 2026

The US-based mortgage company theLender has been listed on the leak site of the ransomware group known as termite. The announcement, which appeared on September 22, 2026, indicates a significant data breach involving the financial services provider.

The claims made by termite

The termite group has published data they claim belongs to theLender on their leak platform. According to the announcement created on September 22, 2026, the group alleges that they have successfully gained access to the organization's systems. While the group has made these claims publicly, information regarding this specific group remains limited in the public domain. It is common for ransomware groups to use leak sites to host stolen information as a method of public pressure.

This tactic is often associated with a strategy known as double extortion. In such scenarios, threat actors do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information to threaten its public release. By publishing data, the attackers aim to increase the pressure on the victim organization to meet ransom demands, leveraging the threat of reputational damage and regulatory scrutiny.

Details of the allegedly leaked data

The screenshots provided by the attackers display various financial documents that appear to belong to the organization's clients. These documents include individual loan application forms as well as title and mortgage reports. The visibility of these documents suggests that a wide range of sensitive information has been compromised. Based on the available evidence, the following types of information are identified as being affected:

• Personal identification information
• Financial data
• Address information
• Income information

The nature of the allegedly leaked data may pose a high risk of identity theft and financial fraud for the organization's customers. When sensitive documents like loan applications and mortgage reports are exposed, the information contained within them can be exploited by various malicious actors for secondary attacks or targeted phishing campaigns.

The organization profile

theLender is a wholesale mortgage company based in the United States. Founded by experienced industry leaders, the company aims to provide innovative solutions within the wholesale mortgage market.

Implications and industry context

This incident highlights the significant risks faced by financial institutions in the modern threat landscape. As a financial institution operating in the US, this incident could lead to legal consequences under state-level data privacy laws and federal regulations. Depending on the jurisdiction and the specific nature of the data, the organization may be required to notify affected individuals and provide credit monitoring services to mitigate the impact on their clients.

The potential for secondary exploitation is a major concern for organizations in the financial services sector. Stolen data, such as income details and personal identification, can be used to fuel sophisticated phishing operations designed to trick individuals into revealing even more sensitive credentials or transferring funds. This cycle of exploitation makes the initial breach even more damaging to the long-term security of the customers involved.

For organizations operating in similar sectors, maintaining robust defensive postures is essential. This typically involves implementing multi-factor authentication, maintaining rigorous patch management cycles, and conducting regular security awareness training for employees. Furthermore, organizations must be prepared for the regulatory and legal complexities that arise following a data exposure, including the necessity of rapid incident response and transparent communication with stakeholders and regulatory bodies.