The Money Store data breach: what to do now

What happened

The Money Store says it noticed unusual activity on September 9, 2026. An unauthorized third party had gotten in on or about September 8, 2026, through a remote monitoring and management tool used by one of its outside service providers, and took information from the affected systems. The company says it took those systems offline, hired cybersecurity specialists, and notified federal law enforcement. Notice letters are dated October 15, 2026.

A ransomware group called Storm listed The Money Store on its leak site in late September, and at least two class action lawsuits were filed in federal court in New Jersey in October. The company hasn't published how many people were affected. Its Rhode Island filing lists about 43 residents.

What information was exposed

The Money Store's notice says the stolen information came from residential mortgage loan files, including origination, underwriting, and closing documents. It doesn't list the specific items, but your letter does. The lawsuits allege the files included:

• Names and contact information
• Social Security numbers
• Financial account information
• Loan application details, income, and employment records
• Property, mortgage, and credit history documents

The notice also says that if you provided tax documents listing dependents, their names and Social Security numbers may be involved too.

What to do now

1. Enroll in the free IDX identity protection in your letter at app.idx.us or by calling 1-866-200-0951, using your enrollment code. The deadline is January 15, 2027. Coverage is 12 or 24 months, as stated in your letter.
2. Freeze your credit at Equifax, Experian, and TransUnion. It is free, stops anyone from opening new credit in your name, and you can lift it any time. If your dependents' information may be involved, you can also request free freezes for children under 16.
3. Never change where you send mortgage payments because of an email, text, or call, even if it looks real. Scammers use stolen loan files to send convincing fake payment instructions. Confirm any change by calling your loan servicer at a number on your statement.
4. Check your bank statements and tell your bank about anything you don't recognize.
5. Get your free credit reports at AnnualCreditReport.com and look for accounts you didn't open.

Ask The Money Store to delete your data

Fewer copies of your information means less to steal next time. The Money Store is a mortgage lender, so loan records it must keep by law, and financial information covered by the federal Gramm-Leach-Bliley Act (GLBA), are generally exempt from state deletion rights. Other information, such as marketing lists or quotes from people who never took a loan, may still be deletable.

Your legal right to deletion

If you live in a state with a consumer privacy law, such as California, Colorado, Connecticut, Maryland, Minnesota, or Oregon, The Money Store generally has to respond to your deletion request within the deadline your state sets, though loan records and financial information covered by the GLBA are generally exempt. See what your state's law requires.

Sources: California Attorney General breach notice and Mortgage Professional America. DataTrail isn't affiliated with The Money Store. This page is general information, not legal advice.