SitusAMC Holdings Corporation, a company that provides mortgage-related services to financial institutions, has disclosed that an unauthorized third party gained access to its information technology network and acquired data from certain systems between November 13 and November 21, 2025. SitusAMC says it discovered the intrusion around November 12, 2025, and responded by launching an investigation with outside experts, notifying law enforcement and government authorities, and working to contain the incident. Based on the details provided, this appears to have been a case of hacking or system intrusion rather than a targeted phishing scheme or lost device.
Because SitusAMC works with various financial institutions on mortgage transactions, the personal information involved may belong to borrowers as well as non-borrowers connected to those transactions. The notification letter does not provide a total number of affected individuals, so it’s not possible to say how widespread this incident is beyond confirming that your information was part of the reviewed data.
What information was exposed?
- Full name
- Address
- Date of birth
- Social Security number
- Driver’s license number or other government-issued identifier
- Financial account information, such as a bank account number or credit or debit card number
Not every data element was involved for every individual; the specific combination varies from person to person.
SitusAMC is offering affected individuals identity theft protection services through IDX at no cost, including 24 months of credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy, and fully managed ID theft recovery services. To activate this protection, enroll at https://app.idx.us/account-creation/protect using the Enrollment Code provided in your letter. The deadline to enroll is July 3, 2026.
What should you do now?
- Enroll in the free IDX identity protection offer before the July 3, 2026 deadline, and make sure to activate the credit monitoring component, since it is not automatic once you sign up.
- Place a fraud alert or a security freeze with the three major credit bureaus (Equifax, Experian, and TransUnion) so lenders must verify your identity before opening new credit in your name.
- Order your free credit reports at annualcreditreport.com and review them closely for accounts or inquiries you don’t recognize.
- Watch your bank and credit card statements over the next 12 to 24 months for unfamiliar transactions, since your financial account information may have been exposed.
- Because your Social Security number and driver’s license number may be involved, consider signing up for a service like Aura or LifeLock, which can alert you if your information appears elsewhere, such as on the dark web.
- Be cautious of unsolicited calls, emails, or texts asking for personal information or directing you to log in and verify your details — scammers sometimes use breach news as a pretext.
- If you notice suspicious activity, file a report with your local police department and with the FTC at IdentityTheft.gov, and keep copies of all related correspondence.
If you have questions, SitusAMC can be reached at (844) 814-3163 (Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern Time), by email at [email protected], or by mail at 5065 Westheimer Rd., Suite 700E, Houston, TX 77056, Attention: Legal/Regulatory Office.