CoreRecon Threat Intelligence • Mortgage Brokers & Lenders • June 2026

TX Mortgage:
High-Value Target

loanDepot (16.9M borrowers), Mr. Cooper (14.7M), LoanCare, FNF/First American, Fairway, Academy — six named mortgage companies breached 2023–2025 by ALPHV, LockBit, and Black Basta ransomware groups. Wire fraud BEC drained $446M from real estate transactions in 2024 alone. GLBA Safeguards §314.4 nine-element mandate is now actively enforced. Texas TDPSA creates a private right of action for affected borrowers. Your NMLS surety bond is at risk on a documented breach.

30.9 million borrowers exposed across six named mortgage company breaches in 24 months
ALPHV/BlackCat specifically targeted non-bank servicers — loanDepot demanded ~$15M ransom (Jan 2025)
Wire fraud BEC: 30-minute recall window — after 30 min, Fedwire recall success rate drops below 40%
GLBA Safeguards §314.4 actively enforced by FTC — nine documented elements, QI designation required
TDPSA (July 2024): TX borrowers have private right of action — class action exposure on breach response failures

Download the Full Threat Brief — Free

June 2026 CoreRecon Intelligence Report V35 62 Verified Sources GLBA §314.4 + TDPSA + NMLS + Wire Fraud

What This Brief Covers

TX Mortgage Brokers & Lenders
Cyber Threat Brief

Full intelligence report on the attack surface facing Texas mortgage brokers and independent mortgage bankers — from the loanDepot ALPHV ransomware breach (16.9M) and Mr. Cooper attack (14.7M) to LoanCare/FNF third-party breach propagation, Fairway wire fraud BEC anatomy, Academy data exposure, and the GLBA Safeguards §314.4 nine-element compliance gap most TX mortgage firms carry. 62 verified sources. No marketing fluff. Documented incidents, applicable regulations, and actionable controls built for mortgage broker-owners, MLOs, and compliance officers.

62 Verified Sources Including:

loanDepot 2025 8-K SEC disclosure — ALPHV/BlackCat ransomware, 16.9M borrowers, ~$15M ransom demand
Mr. Cooper breach notification — 14.7M borrower records, payment processing offline, CFPB servicing review
FNF Group / First American / LoanCare incident — 1.3M+ borrowers via FirstConnect platform, TPA propagation
Fairway Independent Mortgage BEC case study — TX closing wire fraud, 47-min detection, Fedwire recall
Academy Mortgage data exposure — LOS third-party vendor access, GLBA §314.4(f) noncompliance
FBI IC3 2024 Internet Crime Report — $446M real estate wire fraud, BEC attack anatomy
FTC GLBA Safeguards Rule §314.4 — nine-element crosswalk with enforcement guidance and exam questions
TDPSA (Texas HB 4) — private right of action, AG enforcement authority, $7,500/violation civil penalty
NMLS / TDSML licensing bond requirements — breach trigger analysis and surety claim exposure
8 mortgage-specific controls with 30/60/90 implementation roadmap

Access the Full Brief

We email it once. No newsletter. No spam. PDF delivered to your inbox.

First Name *

Last Name *

Work Email *

Company / Brokerage Name *

Your Role

Endpoint Count Range

Work email required. Free email providers (Gmail, Yahoo, Outlook, etc.) are not accepted. By submitting, you consent to CoreRecon processing your information per our privacy policy.

Submission failed — please try again or email john@corerecon.com

Brief Sent.

Check your inbox — the PDF is on its way. If it lands in spam, drag it to your inbox so you find it later.

Questions before then? Call (800) 955-2596 — live TX SOC, not a call center.

Book Free Posture Assessment →

SDVOSB Certified • TX-Based SOC • No offshore data routing
Questions? (800) 955-2596

TX Mortgage:High-Value Target

TX Mortgage Brokers & LendersCyber Threat Brief

62 Verified Sources Including:

Access the Full Brief

Brief Sent.

TX Mortgage:
High-Value Target

TX Mortgage Brokers & Lenders
Cyber Threat Brief