SitusAMC data breach: mortgage data taken November 13 to 21, 2025, 658,333 people

What happened at SitusAMC?

SitusAMC says it became aware on or about November 12, 2025 of unauthorized access to systems in its network, opened an investigation with outside experts and notified law enforcement and government authorities. The investigation found that data was acquired over nine days.

FINRA, the broker-dealer regulator, sent all member firms an alert about the incident. It described SitusAMC as a technology services company for commercial and real estate banks and financiers, and said the breach exposed corporate data, accounting records and legal agreements tied to major financial institutions. FINRA added that banks, pension funds and state governments that rely on SitusAMC were potentially affected.

Date	What happened	Source
On or about November 12, 2025	SitusAMC finds the unauthorized access	SitusAMC letter; FINRA
November 13 to 21, 2025	Data acquired from its systems	SitusAMC letter; Oregon list
February 17, 2026	Discovery date on Oregon's record for the larger report	Oregon list
February 20, 2026	Date on the letters filed in California; first, smaller Oregon report (250)	SitusAMC letter; Oregon list
March 10, 2026	Notice date for 658,333 people; Indiana notice (263 residents)	Oregon list; Indiana report
May 20, 2026	IDX enrollment deadline	SitusAMC letter

Why did I get a letter from SitusAMC?

Because a bank, lender or mortgage investor you dealt with used SitusAMC. The letter says SitusAMC and its affiliates work with financial institutions on mortgage-related services that can involve borrower information, and in some cases information about people who are not borrowers, in connection with mortgage transactions. The guide to why you got a breach letter from a company you never dealt with explains how vendor breaches reach people this way, and the guide to vendor breach notices compares how vendors word them.

What information was exposed?

It varies by person. The letter lists name, address, date of birth, driver's license number or other government ID, and financial account information such as a bank account or card number, with more elements filled in per letter. SitusAMC says it is not aware of any fraudulent use of the information.

How many people were affected?

658,333, per Oregon's list, which also carries a first SitusAMC report of 250 people dated February 20, 2026. Indiana records 263 Indiana residents but no total. The letters give no count. The largest data breaches of 2026 shows where a total of this size sits.

Texas's attorney general lists a report from SitusAMC Holdings Corporation, posted on April 6, 2026, with 36,827 Texans affected. The Texas record lists names, addresses, Social Security numbers, driver's license numbers, other government ID numbers, financial account or card numbers, medical information, health insurance information and dates of birth among the information involved. Of the 607 reports Texas posted in 2026 up to November 10, it is the 66th largest by Texans affected; the Texas ranking has the largest. The figure counts Texans only.

What is SitusAMC offering?

IDX identity protection: 24 months of credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy and managed identity theft recovery. The enrollment deadline in the letter was May 20, 2026, so the code no longer works. Questions go to IDX at (844) 814-3163. A credit freeze at Equifax, Experian and TransUnion is free and has no deadline; the guide to credit monitoring offers explains the difference.

How many Washingtonians were affected by the SitusAMC breach?

Washington's attorney general lists a notice from SitusAMC Holdings Corporation, reported on February 20, 2026, with a breach date of November 13, 2025 and 20,587 Washingtonians affected. The record lists names, Social Security numbers, driver's license or state ID numbers, financial and banking information, full dates of birth, military ID numbers, passport numbers, health insurance policy or ID numbers and medical information as the information compromised. The Washington ranking compares 2026's notices. The figure counts Washington residents only.

What the record leaves open

• How the intruder got in, and whether files were encrypted.
• Which banks and lenders' customers are among the 658,333.
• Why Oregon holds two SitusAMC reports with different discovery dates.