SitusAMC Holdings Corporation, a company that provides mortgage-related services to financial institutions, has disclosed a data breach involving unauthorized access to its information technology network. SitusAMC says it became aware of the intrusion on or about November 12, 2025, and its investigation later determined that an unauthorized third party had actually acquired data from its systems between November 13 and 21, 2025. The company has classified this as a case of hacking or system intrusion, and it has notified law enforcement and government authorities while working with outside experts to assess and contain the incident.
Because SitusAMC works behind the scenes with various financial institutions on mortgage transactions, people receiving this letter may not have a direct relationship with SitusAMC itself — their information was likely handled by SitusAMC on behalf of a lender, servicer, or other mortgage-related business. The company has not stated a total number of people affected in the portion of the notice made available, and not every affected person had the same data elements exposed.
What information was exposed?
- Full name
- Address
- Date of birth
- Social Security number
- Driver’s license number or other government-issued identifier
- Financial account information, such as a bank account number or credit/debit card number
SitusAMC is offering 24 months of identity theft protection through IDX, which includes credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy, and fully managed identity theft recovery services. To activate this coverage, enroll at https://app.idx.us/account-creation/protect using the Enrollment Code included in your letter, and note that the deadline to enroll is July 3, 2026.
What should you do now?
- Enroll in the free IDX identity protection offer before the July 3, 2026 deadline and be sure to activate the credit monitoring component, since it does not turn on automatically.
- Because your Social Security number, driver’s license number, and financial account details may have been exposed, place a fraud alert or a security freeze with all three credit bureaus (Equifax, Experian, and TransUnion) so new accounts cannot be opened in your name without extra verification.
- Review your bank and credit card statements closely for the next 12 to 24 months, and report any unfamiliar charges to your financial institution right away.
- Watch for unexpected mail, calls, or account notices about loans or credit you did not apply for, which can be an early sign of identity theft.
- Consider signing up for a service like Aura or LifeLock, which can alert you if your information appears elsewhere and help you respond quickly if something looks wrong.
- Be cautious of emails, texts, or calls referencing this breach that ask you to click a link or share personal information — go directly to the official IDX enrollment site instead of clicking through unsolicited messages.
- If you notice signs of fraud, file a report with your local police department and with the FTC at IdentityTheft.gov, and keep copies of everything for your records.
If you have questions, SitusAMC can be reached at (844) 814-3163 (Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern Time), by email at [email protected], or by mail at 5065 Westheimer Rd., Suite 700E, Houston, TX 77056, Attention: Legal/Regulatory Office.