Impac Mortgage Holdings, Inc. data breach

Clerk's notes

Impac Mortgage Holdings, Inc., a specialized mortgage lending and servicing institution, reported a data security incident to the Washington Attorney General on April 17, 2026. The nature of the breach remains unspecified, but its disclosure to regulatory bodies indicates a significant compromise of digital infrastructure. The incident is currently under monitoring, with investigations ongoing.

The compromised information includes highly sensitive personal and financial details such as Full Name, Social Security Number, Date of Birth, Financial Account Number, Routing Number, Credit Score Information, Mailing Address, and Income and Employment Details. This combination of data is particularly valuable to threat actors and poses a substantial risk of long-term identity theft and financial fraud for affected individuals. Unlike a credit card, these identifiers cannot be easily changed, increasing potential harm.

As a financial institution, Impac Mortgage Holdings, Inc. is subject to stringent regulations like the Gramm-Leach-Bliley Act (GLBA) and various state data protection laws. These frameworks mandate the implementation of robust administrative, technical, and physical safeguards to protect customer data. The occurrence of a breach involving such sensitive data suggests potential deficiencies in the company's cybersecurity protocols or its ability to secure customer information against unauthorized access.

Individuals who received a data breach notification letter from Impac Mortgage Holdings, Inc. have a concrete basis to explore their legal rights. The increased risk of future harm, even without immediate financial loss, is recognized as actionable damage. Our firm is currently investigating potential class action claims related to this incident. There are no out-of-pocket costs or attorney fees for participants unless compensation is successfully recovered.

This incident highlights ongoing vulnerabilities within the financial housing sector, particularly among major mortgage servicers. When institutions entrusted with such critical personal data experience security failures, it necessitates thorough legal review and accountability to ensure better data protection practices moving forward. Affected parties in Washington and nationwide are encouraged to understand their options for recourse.

If a notification letter about this breach reached you, see every Washington data breach on file or browse all cases.