Impac Mortgage data breach: 61,066 people told in March 2026 about a 2024 intrusion

What happened in the Impac Mortgage breach?

The letter says that on March 20, 2024 Impac identified indications of potential unauthorized access to its systems, launched an investigation, secured its systems and reported the event to federal law enforcement. The investigation found that the unknown actor may have accessed certain files and folders with protected information between February 21 and March 20, 2024. The letter does not say how the actor got in or whether the attack was ransomware.

Date	What happened	Source
February 21, 2024	Start of the access window; breach date in Indiana's record	Letter; Indiana report
March 20, 2024	Impac finds signs of unauthorized access; end of the access window	Letter
March 27, 2026	Letters dated; notice sent, per Indiana	Letter; Indiana report
April 17, 2026	Notice recorded by California, with no breach date given	California list

Why did Impac take two years to send letters?

The letter's own explanation is the file review. After the investigation, Impac says, it began an extensive review of the affected files to find out whether sensitive information was in them, whom it related to, and the missing addresses of the people involved; it sent the notice once that review was finished. From March 20, 2024 to March 27, 2026 is 737 days. The notice-delay guide shows how that compares with other notices.

California's list records the notice on April 17, 2026 with the breach date given as "n/a".

What information was exposed in the Impac breach?

Name and Social Security number, per the letter filed with California. The letter says there is no evidence of identity theft or fraud tied to the event. The letter does not say whether the people affected are borrowers, applicants, staff or others.

How many people were affected?

61,066 in total, per Indiana, including 182 Indiana residents. The California copy of the letter says about 11 Rhode Island residents may be affected. California's record gives no total.

Texas's attorney general lists a report from Impac Mortgage Holdings, Inc., posted on April 22, 2026, with 1,431 Texans affected. The Texas record lists names, addresses and Social Security numbers among the information involved. The Texas ranking lists 2026's largest reports. The figure counts Texans only.

What is Impac offering people who got a letter?

Single-bureau credit monitoring, a credit report and a credit score through Cyberscout, a TransUnion company, at no charge; the number of months is printed on each letter and is blank in the public copy. People must enroll themselves. Questions go to 833-877-5456, Monday to Friday, 8:00 a.m. to 8:00 p.m. Eastern time. The guide to credit monitoring offers compares this offer with others, and the bank, brokerage and mortgage notice guide covers what other lenders have told customers.

How many Washingtonians were affected by the Impac Mortgage breach?

Washington's attorney general lists a notice from Impac Mortgage Holdings, Inc., reported on April 17, 2026, with a breach date of February 21, 2024 and 1,206 Washingtonians affected. The record lists names and Social Security numbers as the information compromised. The Washington ranking compares 2026's notices. The figure counts Washington residents only.

What the record leaves open

• How the unknown actor got into Impac's systems.
• Whether the people affected are borrowers, applicants, employees or a mix.
• Why the address search took until 2026.