UWM says it was not part of alleged breach

United Wholesale Mortgage is refuting a plaintiff's claims that the top lender was affected in a vendor data breach.

Michigan resident Ricky LaFountain sued UWM in a Michigan federal court Wednesday for negligence, over the company's purported role in a vendor incident last year. In a statement last week, a spokesperson for UWM said the lender did not experience a data breach, nor were any of its systems compromised. 

Attorneys for LaFountain, who didn't return requests for comment last week, wrote that UWM customers' personal identifiable information, including Social Security numbers, were compromised in the hack at accounting firm Mercadien. The filing doesn't say how LaFountain or his attorneys determined UWM's relationship with Mercadien, and the lender has not disclosed doing business with Mercadien in any public filings.

The New Jersey-based tax and accounting firm last November disclosed that it suffered a data breach between last September and October. The incident affected over 402,000 customers, according to the company's disclosure to the Indiana Attorney General's office. Pennsylvania-based Orrstown Bank has revealed it was affected by the breach, while another consumer has sued a separate Pennsylvania-based bank over its alleged involvement. 

In a statement shared with National Mortgage News last week, a spokesperson for UWM emphasized that the company was not involved in the incident. 

"This lawsuit stems from a cybersecurity incident involving a third-party accounting firm and appears to broadly name multiple parties that were not the source of the incident, seemingly in an effort to generate headlines rather than reflect the facts," the statement read. "We believe the claims against UWM are without merit and intend to defend ourselves accordingly."

The lawsuit, like many other breach complaints, blames UWM for its alleged lack of security safeguards, and for failing to notify customers affected by the Mercadien incident.

More data breach lawsuits

The complaint is a rare, if not first data breach lawsuit against the wholesale leader, as many other top lenders have been hit with hacks and subsequent litigation from borrowers. In the past month alone, California-based Optimum First Mortgage and Plaza Home Mortgage were sued over hacks they recently disclosed. 

Some lenders are also wrapping up data breach cases well before they've reached class certification stages. SitusAMC quickly reached a $5.3 million settlement with a plaintiff for a breach affecting hundreds of thousands of consumers. Lenders AnnieMac and McLean Mortgage also told federal courts in recent months that they've reached agreements with consumers to settle lingering cybersecurity suits.