Plaza Home Mortgage data breach: 137,976 people after an employee's computer was accessed in February 2026

How many people were affected by the Plaza Home Mortgage data breach?

137,976 in total, the number Plaza reported to Indiana. The letter gives no count. The state lists count their own residents:

Regulator	Who it counts	Number	Recorded
Indiana attorney general	Total reported by Plaza	137,976	Notice sent May 29, 2026
Texas attorney general	Texans	12,610	Posted June 9, 2026
Washington attorney general	Washington residents	9,598	Reported June 5, 2026
Massachusetts consumer affairs office	Massachusetts residents	4,033	Reported June 17, 2026
Indiana attorney general	Indiana residents	1,490	Notice sent May 29, 2026
California attorney general	No count published	—	Recorded June 5, 2026

The ranking of 2026's largest breaches explains how Indiana's list counts totals and why the state figures differ.

What happened, and when?

Plaza says its security controls flagged the access at once and it acted immediately to shut the attack down, then removed the threat actor from its systems and investigated.

Date	Event
On or around February 17, 2026	Unauthorized access to one employee's computer
May 19, 2026	Date on the letters
May 29, 2026	Notice sent, per Indiana
June 5, 2026	Notice recorded by California and reported to Washington
June 9, 2026	Notice posted by Texas
June 17, 2026	Notice reported to Massachusetts

From the access to the date on the letters took 91 days, and to Indiana's notice date 101. The guide to notice delays compares this with the rest of the log.

What information was involved?

The letter says the information may have included name, address, Social Security number, birth date, driver's license or other government identification, and information related to mortgage loan applications and servicing. It adds that the information was not the same for each person. For its 9,598 residents, Washington's attorney general also lists usernames and passwords or security question answers. Massachusetts marks Social Security numbers and driver's license numbers as breached for its 4,033 residents. The guide to bank, brokerage and mortgage breach notices sets out what other lenders' letters say.

What is Plaza Home Mortgage offering?

Item	Detail from the letter
Service	12 months of credit monitoring and identity theft services from CyEx ("Financial Shield Complete": one-bureau credit monitoring, financial transaction and home title monitoring, $1 million identity theft insurance)
Enrollment	With the activation code and before the deadline printed on each letter
Help line	844-953-3450, Monday to Friday 8 a.m. to 11 p.m. and Saturday 9 a.m. to 6 p.m., except holidays
Advice	Monitor financial accounts, place a fraud alert with one of the three credit bureaus, and check credit reports periodically

California's record also holds a second letter, for employees. The guide to credit monitoring offers compares offers like this one.

What the documents leave open

• How the threat actors got into the employee's computer, and how long they had access.
• Whether the 137,976 people are borrowers, applicants or others, and which data each had involved.
• Why Washington lists account credentials when the letter does not.