loanDepot reports encryption of data and later notifies up to 16.9 million people

loanDepot, the mortgage lender, disclosed on January 8, 2024 that a cybersecurity incident had affected some of its systems and that the unauthorized activity included encryption of data. It filed under Item 8.01 rather than Item 1.05, three weeks after Item 1.05 took effect, and did not reach a materiality view in its first filings.

Original filing

loanDepot shut down some systems and began notifying regulators and law enforcement.

January 22 amendment

The first 8-K/A attached a press release and stated the materiality question was still open.

February 27 amendment

The second amendment gave the scale and a quarterly cost. loanDepot expected a material effect on first-quarter 2024 results but not on the full year, with $12 million to $17 million of expenses net of expected insurance recovery.

Not stated

The filings give no detection date and do not describe how the intrusion began.