Utah-Based Mortgage Company Must Pay $825,000 for Failing to Protect Californians’ Personal Information

What You Need to Know: DFPI ordered the company to provide affected customers with free identity theft insurance in addition to the fine.

SACRAMENTO – The California Department of Financial Protection and Innovation (DFPI) announced today that it has ordered the Utah-based Academy Mortgage Corporation to pay $825,000 for failing to adequately protect the personal information of more than 284,443 people, including at least 34,452 California residents. In addition, the company will offer impacted customers free identity theft insurance coverage for one year.

Following a thorough examination, the DFPI found that Academy Mortgage Corporation had serious, longstanding cybersecurity and recordkeeping deficiencies. Its weak security practices left the company vulnerable to a ransomware attack in March 2023. The mortgage company did not detect the cybersecurity breach until after employee credentials were stolen and network security systems were disabled. The DFPI also found that the company did not obtain a written forensic report to adequately document the breach, resulting in limited transparency about the incident.

“Companies that have access to our personal information must have robust, stringent cybersecurity. Failure to do so can make consumers targets of scams and identity theft, and it leaves workplaces vulnerable,” said DFPI Commissioner KC Mohseni. “This penalty should act as a deterrent to companies – strong data protection for Californians is non-negotiable. Cybercriminals are always on the prowl, and companies must have aggressive, effective cybersecurity measures in place.”

Consumers seeking mortgages and other loans often provide a wide range of personal information to companies, including Social Security numbers and birthdates. Under California law, all residential mortgage lenders and servicers must adopt reasonable security procedures to protect customers’ personal information. In addition, they must also follow federal mandates to develop and maintain comprehensive information security programs. Additionally, the DFPI requires licensed entities to have adequate incident response policies and procedures in place. Affected individuals were notified of the data breach in December 2023.

• The FBI reports that in 2025, Americans lost more than $1.3 billion due to personal data breaches.
• The Federal Trade Commission (FTC) says there were more than 1.1 million reports of identity theft in 2024.

What Today’s Action Means

The consent order between the DFPI and Academy Mortgage Corporation means that, in addition to paying the financial penalty above, the company must:

• Notify all affected California customers that they are entitled to identity theft insurance coverage for 12 months. Consumers must opt in to receive this remedy. The notice will contain opt-in instructions. A point of contact for consumer inquiries will be established.
• Comply with all California laws and maintain an adequate cybersecurity system and processes.

Consumers who believe a financial services provider has engaged in unlawful, unfair, deceptive, or abusive practices may submit a complaint with the DFPI at Submit a Complaint – DFPI or call (866) 275‑2677.

About DFPI

The Department of Financial Protection and Innovation protects consumers, regulates financial services, and fosters responsible innovation. DFPI protects consumers by establishing and enforcing financial regulations that promote transparency and accountability. We empower Californians to access a fair and equitable financial marketplace through education and by preventing potential risks, fraud, and abuse. Learn more at dfpi.ca.gov.