American Lending Center data breach: July 2025 ransomware attack, clients told in 2026

What happened at American Lending Center?

A forensic investigation found that the attacker had compromised the internal network, run ransomware and accessed files that may have contained personal identifying or sensitive information. The letter says there is no evidence any of the information has been misused. It does not name the ransomware group, say whether a ransom was paid, or say how the attacker got in.

California's record lists four breach dates: July 24, 26, 27 and 30, 2025. The company then ran what it calls a data mining exercise to work out what was in the files and whose it was. That finished on April 8, 2026. The notices followed 20 days later, nine months after the attack.

Date	What happened	Source
July 24, 26, 27 and 30, 2025	Breach dates; ransomware attack	California AG record, notice letter
April 8, 2026	Review of the files finished	Notice letter
April 28, 2026	Notice sent, per Indiana	Indiana record
May 13, 2026	Reported to Washington	Washington list
May 14, 2026	Published by Texas	Texas AG list

The guide to ransomware in 8-K filings shows how listed companies describe the same kind of attack to investors. The guide to how long organizations take to notify sets the nine-month gap against other letters in this log.

What information was taken in the American Lending Center breach?

The letter names name, date of birth and Social Security information, "among other points of information". The state records say more about those other points:

• Texas lists Social Security number, driver's licence number, government-issued ID such as a passport or state ID card, financial information, medical information and date of birth.
• Washington lists name, Social Security number and full date of birth.

The letter calls the people affected its clients. It does not say whether they are borrowers, applicants or others whose files the company held.

How many people were affected?

Indiana gives the only total: 123,158 people. Three states count their own residents:

Record	People counted
Indiana attorney general, total	123,158
Texas residents	7,644
Washington residents	6,049
Indiana residents	1,083

Texas published its report on May 14, 2026, with notice by U.S. mail. Washington's 6,049 is more than five times Indiana's 1,083; the records give no breakdown for other states. The Washington ranking and the ranking of breaches affecting Texans compare the counts. The guide to bank, brokerage and mortgage breach notices compares what other lenders have told clients.

What is American Lending Center offering?

IDX identity protection: credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy and fully managed identity theft recovery. The filed sample leaves the length as "[12 months/24 months]", so each letter says which. Enrolment is at app.idx.us/account-creation/protect, or on 1-800-939-4170, with the code at the top of the letter and by the deadline it gives. The guide to credit-monitoring offers compares this offer with others.

Was my information in the American Lending Center data breach?

If a letter headed "Notice of Data Breach" from American Lending Center reached you in spring 2026, your information was in the files. IDX's line, 1-800-939-4170, is open Monday to Friday, 9 a.m. to 9 p.m. Eastern Time, and its staff have been briefed on the incident. Keep the letter: the enrolment code at its top is needed to sign up.

What the notice leaves open

• How the attacker got into the network, and which ransomware group was behind it.
• Whether a ransom was paid, and whether files were published.
• Who the 123,158 people are: borrowers, applicants or others.
• Which items each person lost beyond name, date of birth and Social Security information.