SitusAMC Holdings Corporation (“SitusAMC”) has announced a data security incident involving unauthorized access to certain systems within its information technology network. According to the notice, SitusAMC became aware of unauthorized activity on November 12, 2025, and determined that an unauthorized third party had acquired data from specific systems between November 13 and November 21, 2025.
Upon discovering the incident, SitusAMC initiated an investigation with the assistance of third‑party forensic experts, notified law enforcement authorities, and implemented additional security measures to contain and assess the impact. The investigation concluded that certain personal information stored within its systems—including borrower and, in some cases, non‑borrower mortgage‑related data—had been accessed and acquired.
SitusAMC provides mortgage‑related services to various financial institutions, which may involve holding or transferring sensitive consumer information during mortgage transactions.
The impacted data relates to individuals whose information was within the affected systems during the period of unauthorized access.
Following its review, SitusAMC began issuing formal notification letters to affected individuals and is offering complimentary identity theft protection services through IDX, which includes 24 months of credit and CyberScan monitoring, identity restoration assistance, and up to $1,000,000 in reimbursement insurance.
If you received a Data Breach Notification Letter from SitusAMC, it confirms that your personal information may have been accessed and/or acquired by an unauthorized party.
What information is involved in the SitusAMC Holdings Corporation Data Breach?
Compromised information may include:
Name
Address
Date of Birth
Driver’s license number or other government-issued identification
Financial account information (bank account number, credit/debit card number)
Other mortgage-related personal data depending on the individual record
Your Personally Identifiable Information (PII) includes details that can directly identify you and place you at increased risk if exposed. Financial account information and government identification numbers are particularly sensitive and may increase vulnerability to identity theft, financial fraud, or unauthorized account activity.
If Protected Health Information (PHI) was involved, this may include data protected by HIPAA and state privacy laws. Exposure of PHI elevates risks of medical‑related fraud, insurance misuse, or unauthorized access to health‑related services.
If additional sensitive consumer data was involved, the breach may subject impacted individuals to long‑term risk of credit misuse or fraudulent transactions. SitusAMC states that it is not aware of fraudulent misuse at this time; however, individuals are encouraged to remain vigilant and review statements, financial accounts, and credit reports closely. [SitusAMC -…lates – CA | PDF]
While no confirmed misuse has been reported, data compromise involving personal identifiers and financial information increases the risk of unauthorized access, account takeover, or targeted phishing attempts.
Residents of California benefit from enhanced privacy protections under the California Consumer Privacy Act (CCPA), which provides additional rights regarding the collection, storage, and protection of personal information. California residents may also have additional legal remedies when personal data is compromised in a breach.
Individuals affected by this breach should monitor financial statements, credit reports, and any communications from financial institutions for suspicious or unexpected activity.
Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review.