Mortgage company Bayview settles for $20M with state financial regulators, including Ohio, over data breach

COLUMBUS, Ohio – Ohio and 52 other financial regulatory agencies across the country getting a piece of a $20 million settlement from the nation’s largest nonbank mortgage company after a data breach affected 5.8 million customers, including 138,000 Ohioans, according to the Ohio Division of Financial Institutions.

Bạn đang xem: Mortgage company Bayview settles for $20M with state financial regulators, including Ohio, over data breach

The company, Bayview Asset Management LLC, and its three affiliates – Lakeview Loan Servicing, Community Loan Servicing and Pingora Holdings – failed to comply with the agencies’ examination authority after an earlier data breach.

Xem thêm : Fed cuts but mortgage rates could be ‘higher for longer’

As a result of the October 2021 breach, the company had provided consumer notifications and support services, including free consumer credit and identity theft monitoring. But the companies, when informing state and federal regulators about the breach, failed to meet the notification requirements in a timely manner, according to Housing Wire, which reviewed a copy of the settlement.

“This settlement highlights the commitment of the Ohio Division of Financial Institutions to protecting consumers’ personal information in the wake of data breaches,” said Kevin Allard, superintendent of the Division of Financial Institutions, in a prepared statement. “State regulators have coordinated to hold companies accountable and demonstrate that protecting sensitive consumer data is non-negotiable. Actions like this also underscore the importance of cybersecurity compliance as a responsibility that must not be taken lightly.”

Cleveland.com/The Plain Dealer reached out to the Ohio Division of Financial Institutions to ask what the state plans to do with its share of the settlement.

California, Maryland, North Carolina and Washington state regulators led the investigation, which found that Bayview Companies’ information technology and cybersecurity practices did not meet federal or state requirements. Furthermore, the Bayview Companies delayed the supervisory process when the states were examining the extent of the breach and internal security by failing to comply with state requests in a timely and complete manner in the early stages of the examination, the statement said.

Xem thêm : Mortgage servicing orgs hit with massive penalty

The settlement is with regulators in all 50 states, Puerto Rico and Washington, D.C.

In addition to the monetary penalty, the Bayview Companies agreed to corrective actions, improve cybersecurity programs, undergo independent assessments and provide three years of additional intensive reporting to the states, the statement said.

State financial regulators license and supervise over 33,000 nonbank financial services companies through the Nationwide Multistate Licensing System, including mortgage companies, money services businesses, consumer finance providers and debt collectors.

Laura Hancock covers state government and politics for The Plain Dealer and cleveland.com.