The cyber attack on homebuilder D.R. Horton’s mortgage division impacted a crucial piece of the lender’s mortgage technology; it’s online point of sale system. It’s not certain whether the application that was comprised in the security breach was built in-house or is a private-labeled version of a commercial POS application, but many signs indicate that it’s likely a custom-built technology.
The domain name and corresponding Internet protocol address for DHI Mortgage’s online application website is registered to DR Horton. The company also manages the site’s two domain name system servers, which essentially translate the domain name a user types into a Web browser into the site’s corresponding IP address. The secure certificate for the site is also registered to DR Horton.
“If you look at the domain name servers listed for that domain name, a lot of times if they’re using a third party, they’ll use a third party’s DNS servers,” explained Randy Schmidt, president of Mishawaka, Ind.-based Data-Vision, a vendor of Web-based mortgage POS technology who reviewed DHI Mortgage’s website for Mortgage Technology.
MT confirmed that Horton uses the Empower loan origination system of Jacksonville, Fla.-based vendor Lender Processing Services, but does not use LPS’s optional online point of sale application. However, the information that Horton’s POS application gathers is later used by the lender when it’s originating loans with the LOS. The transfer can be manual, but many POS and LOS applications have direct integrations.
“This did not involve any Empower technology or databases and it did not extend to the Empower application,” said Michelle Kersch, LPS senior vice president of corporate communications.
Schmidt noted that while Horton’s Web server manages the domain, it is possible that its POS tool is hosted by an outside vendor. “We have several customers that have elected to do that, but most of our customers have us manage the DNS for them,” he said.
“Everything I can see right now looks like it might be something they’ve done themselves. There’s not anything that’s pointing me to anybody else,” Schmidt said. “That doesn’t mean that it isn’t, but there’s nothing that’s pointing me in that direction.”
Fort Worth, Texas-based Horton disclosed Thursday that its DHI Mortgage unit suffered a “software security breach by unknown external sources in its Internet Loan Prequalification System.”
A Horton representative did not return a call seeking comment, but in a company statement, Horton said it is addressing the issue.
“Upon identifying the security breach, DHI Mortgage took immediate steps to remedy the breach by isolating the affected server, purging certain affected files and modifying our electronic security measures to address the specific issue,” Horton said in a statement.
“We are in the process of notifying affected customers that their personal data may have been compromised,” the statement continues. “We regret the inconvenience to our customers, and encourage them to follow the precautionary actions outlined in the email or letter that they receive.”
Concerns about data security risks with their in-house technology have prompted many lenders to seek out third-party vendors. But it can also discourage lenders from acquiring technology to add new functionality, like the ability to take loan applications and prequalify borrowers online.
“It makes it a little bit harder and a little bit longer sales of a sales cycle because people are going to do a little bit more due diligence. But we’re pretty confident in our ability to alleviate any concerns they have,” Schmidt said. “It could actually drive people who are doing things in-house to decide to go to a vendor and offload a lot of that responsibility and cost of putting up a secure infrastructure.”
Austin, Texas-based DHI Mortgage originated or brokered 10,262 mortgages in Horton’s 2011 fiscal year that ended on Sept. 30, providing financing for approximately 61% of the 16,695 homes that Horton closed during that period. DHI Mortgage reported income before taxes of $19.1 million for its 2011 fiscal year, down 11% from FY2010.
In its FY1Q12 that ended on Dec. 31, 2011, Horton originated or brokered 2,458 mortgages for 60% of the homes closed during the period, generating $4.2 million in income before taxes.
After origination, loans are sold servicing released to correspondent investors. In its Nov. 17 annual report, Horton said 89% of its loans were sold to one of two major financial institutions, but that one of those investors intended to exit the correspondent channel and stop purchasing Horton loans after December 2011.
In its FY1Q12 financial results reported on Jan. 27, Horton said 76% of the loans it sold went to one correspondent investor.
“The Company has been negotiating with other institutions to establish additional loan purchase agreements to increase its options for additional competitive pricing,” the financial filing reads. “If the Company is unable to sell mortgage loans to additional purchasers on attractive terms, the Company's ability to originate and sell mortgage loans at competitive prices could be limited which would negatively affect profitability.”
For more information about online POS applications, read the March issue of Mortgage Technology, available for e-edition download on March 12 at
