SitusAMC Holdings Corporation, a company that provides mortgage-related services to financial institutions, has disclosed that an unauthorized third party gained access to its information technology network. The company says it became aware of the intrusion on or about November 12, 2025, and its investigation determined that data was acquired from its systems between November 12 and November 19, 2025. This falls under hacking or system intrusion, and SitusAMC states it brought in third-party forensic experts, notified law enforcement, and took steps to contain the incident and harden its security once the activity was discovered.
The letter was sent to individuals whose personal information was identified as part of the data involved in this incident. SitusAMC notes that not every data element listed below was involved for every person, and the company has not stated a total number of affected individuals in the notice provided.
What information was exposed?
- Full name
- Address
- Date of birth
- Social Security number
SitusAMC is offering 24 months of identity theft protection through IDX, which includes credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy, and fully managed ID theft recovery services. To enroll, go to https://app.idx.us/account-creation/protect and use the unique enrollment code printed in your letter; the deadline to enroll is April 28, 2026. Note that the credit monitoring portion must be separately activated to take effect.
What should you do now?
- Enroll in the free IDX identity protection offer before the April 28, 2026 deadline and activate the credit monitoring component, since it does not work automatically.
- Because your Social Security number and date of birth were involved, consider placing a fraud alert or a security freeze with Equifax, Experian, and TransUnion — freezes are free and prevent new accounts from being opened in your name without your authorization.
- Pull your free credit reports from all three bureaus at annualcreditreport.com and review them for accounts or inquiries you don’t recognize.
- Watch your bank and credit card statements closely for the next 12 to 24 months, as regulators recommend, and report anything suspicious right away.
- Be cautious of unsolicited emails, texts, or calls asking you to verify personal information or click a link — scammers sometimes use breach news to impersonate companies.
- For ongoing peace of mind, consider signing up for a service like Aura or LifeLock, which can alert you if your Social Security number or other personal details show up somewhere they shouldn’t.
- If you notice signs of fraud, file a report with your local police department and with the FTC at IdentityTheft.gov to create an official identity theft record.
If you have questions, SitusAMC can be reached at (844) 814-3163 (Monday through Friday, 9 a.m. to 9 p.m. Eastern Time), by email at [email protected], or by mail at 5065 Westheimer Rd., Suite 700E, Houston, TX 77056, Attention: Legal/Regulatory Office.