The Lending Company Of AZ Reports Data Theft But Gives No Help To Those Compromised

Data Theft At Major Arizona Mortgage Company Leaves Many Questions Unanswered

Major incidents of data theft seem to be occurring with alarming frequency.  Even companies with considerable resources seem powerless to prevent the theft of customer records containing sensitive personal and financial data.

Two recent cases involving Michaels Stores and Sony Corp show that even huge companies are vulnerable to hackers.  I will leave it up to the experts to determine whether these data thefts are due to inadequate security protocols, but when they do occur, the company involved should take prompt and serious actions to ensure that damage to customers and employees is limited.

A serious case of data theft has occurred at The Lending Company, a major Arizona mortgage company based in Phoenix, Arizona.  In a letter sent to current and former employees, The Lending Company said,

“We are contacting you about a potential problem involving identity theft.  Recently, we have learned of a data security incident in which someone accessed and potentially downloaded sensitive personnel records including names, contact information, and social security numbers.  We have notified law enforcement  regarding the incident and have provided them with a general report.  Due to the nature of this incident we strongly encourage you to take preventative measures to help prevent and detect any misuse of your information.

We recommend that you place a fraud alert on your credit file…You are encourage to call any one of the three major credit bureaus listed below.”

The Lending Company also suggested that these additional steps be taken:

  1. Check your credit report periodically
  2. Review a copy of the comprehensive FTC guide to guard against identity theft
  3. Contact local law enforcement and file a report if you find suspicious activity on your credit report
  4. File a complaint with the FTC which will add your complaint to their Identify Theft Data Clearinghouse

The response of The Lending Company to this serious case of data theft leaves potential victims of identity theft with many unanswered questions including:

  • How long was it between the data theft and the date is was discovered?
  • Why were potential victims not immediately notified by email or a phone call instead of being informed by “snail mail”?
  • The letter only mentions a theft of personnel records.  Is there also a possibility that the theft of customer loan records occurred, potentially exposing thousands of borrowers to identity theft?
  • Did The Lending Company have reasonable security measures in place to protect customer and employee data?

The Lending Company gave a long list of chores to the victims to minimize their potential losses and aggravation due to identity theft.  Dealing with the credit bureaus, FTC and law enforcement involves a huge time commitment.  Why is The Lending Company not stepping forward with a help line or live support to deal with multiple agencies regarding a data breach that is ultimately the responsibility of The Lending Company?

It is routine in cases involved compromised financial information for the company involved to offer free credit monitoring through a credit bureau which sends alerts regarding potential credit and identity theft risks.  The credit monitoring services also have a team ready to assist victims with fraud resolution and provide identity theft insurance coverage.

The Lending Company is ultimately responsible for the data theft yet has done nothing to assist potential victims other than sending them a letter which basically says “good luck” with your efforts to stop identity theft or fraud that may occur due to data stolen from The Lending Company’s offices.

Companies should be required by law to take immediate steps to protect customers and employees in the case of theft of personal and financial records.  At a minimum, companies who allow sensitive data to be stolen should provide at no charge the best credit and fraud monitoring services available.

The Lending Company has failed to protect data and has now failed to help those who may be at risk of identity theft or worse.  Hopefully, The Lending Company will recognize its responsibility and immediately take more proactive steps to protect its customers and employees.

3 Responses to “The Lending Company Of AZ Reports Data Theft But Gives No Help To Those Compromised”

  1. I’m one of those affected by the data breach at the Lending Company. Your article is spot on. I’m seriously upset that they lost my info, but it ads insult to injury that they don’t step up to protect us after the breach. As an info sec professional in the financial services industry, I find this unconscionable.

    I’m calling the company president and demanding they take care of their responsibilities. If they refuse, I’m going to their regulators, and filing for a class action lawsuit.

    This is a textbook example of how not to run an info sec program, and how not to treat your customers.

  2. Yeah I find this pretty disturbing. I also was a victim of this. The most irritating part is yes they processed my loan but then sold it immediately to Bank of America in March of 09. Now I get a letter in May 2011 telling me they lost my SS #. There should be a law that if you are not a current customer you must delete their sensitive information. Were talking over two years here.

  3. Different states have various record retention rules. Nonetheless, the safeguarding of files should be of paramount concern to the mortgage company that retains the original loan documents.
    Unfortunately, many mortgage companies are focused on closing loans first and protecting consumers data winds up being a low priority.
    With thousands of small mortgage brokers and mortgage companies going under over the past 5 years, I really hate to think about what happened to the loan files of these now defunct lenders.
    There are many laws requiring lenders to protect consumer data. Unfortunately, regulators do not seem focused on ensuring that the laws are complied with.

Leave a Reply