New American Funding Data Breach — Class Action Review

New American Funding is a prominent, independent mortgage banker and financial services provider operating nationwide, specializing in residential home loans, refinancing, and home equity financing. Because of the core nature of its operations, the company routinely collects, processes, and stores vast repositories of highly sensitive consumer and financial data. Securing a mortgage requires individuals to submit deeply intimate details regarding their personal finances, credit history, employment status, and identity. Consequently, New American Funding acts as a custodian for foundational personal and financial information, making its digital infrastructure a high-value target for malicious actors seeking to exploit consumer data.

In 2026, New American Funding reported a significant cybersecurity incident to the Oregon Attorney General, raising severe concerns among consumers regarding the safety of their private information. While the exact vector of the breach remains under active investigation, security incidents affecting financial institutions and mortgage lenders typically involve sophisticated cyberattacks such as unauthorized access to legacy customer databases, compromised employee credentials, or vulnerabilities within third-party vendor networks. Financial sector breaches often stem from cybercriminals leveraging advanced persistent threats to bypass perimeter defenses, exfiltrate sensitive files, or deploy ransomware capable of paralyzing operational networks and compromising sensitive consumer repositories.

The data compromised in incidents involving mortgage lenders typically includes a devastating combination of personally identifiable information and core financial credentials, such as full legal names, Social Security numbers, dates of birth, home addresses, banking account numbers, routing numbers, and detailed credit report histories. The exposure of this specific data matrix creates immediate and long-lasting risks for affected consumers. Unlike a compromised email address, immutable data points like Social Security numbers and banking details cannot be easily changed. When exposed, this information opens the door to catastrophic harms, including sophisticated identity theft, unauthorized financial account takeovers, fraudulent loan applications opened in the victim's name, and targeted financial phishing schemes that can plague victims for years.

As a financial institution handling non-public personal information, New American Funding was bound by strict statutory and regulatory mandates to implement and maintain robust cybersecurity protocols. Under the Gramm-Leach-Bliley Act (GLBA) and the FTC Safeguards Rule, mortgage companies are legally required to establish comprehensive administrative, technical, and physical safeguards to protect sensitive customer records. The occurrence of a widespread data breach strongly indicates a potential failure to satisfy these foundational legal obligations—such as failing to enforce multi-factor authentication, neglecting to patch known software vulnerabilities, or inadequate monitoring of network traffic—which directly exposes the company to legal liability for negligence and breach of implied contract.

Receiving a formal data breach notification letter from New American Funding is a legally significant event that confirms your private information was compromised due to corporate security failures. This notification establishes the legal standing necessary to participate in a class action lawsuit aimed at holding the company accountable for failing to safeguard your data. Under modern legal standards, affected consumers do not need to wait until they experience actual financial fraud or out-of-pocket loss to seek legal recourse; the increased risk of future identity theft and the time and expense required to monitor your credit are recognized harms. Our firm evaluates and litigates these cases on a contingency fee basis, meaning you pay absolutely nothing out of pocket, and we only collect a fee if we successfully recover compensation on your behalf.