Logo

Information About the Mr. Cooper Cyber Incident

Important Update from Mr. Cooper
Thank you for your patience as we have continued investigating the recent cyber incident. To help support our customers, we are offering two years of free credit monitoring and identity protection services through TransUnion to any former or current (as of Oct. 31, 2023) Mr. Cooper customer or customers whose loans we service on behalf of our servicing partners. We will be directly notifying customers and providing them with enrollment instructions for the free identity protection services.
 
Cyber Incident Resources

Cyber Incident Response Line

Mr. Cooper Cyber Incident Response Line, supported by TransUnion
Monday through Friday
8:00 a.m. to 8:00 p.m. ET
Phone1-833-960-4745

Enroll in Free Credit Monitoring

success shieldHave your TransUnion activation code?
Activate Monitoring
question shield
Need your TransUnion activation code?
It is available to current and former customers through their online mortgage account.
 
If you are a former customer, you may have to change your password.
spanish-suport__language-icon
¿Necesitas ayuda en español?
Por favor contáctese al 1-833-960-4745, a la línea designada para preguntas relacionadas con el incidente cibernético que maneja TransUnion, la cual está abierta de Lunes a Viernes de las 8 am a las 8 pm hora este.
“We take our role as your mortgage company very seriously, and there is nothing more important to us than maintaining your trust. I want you to know how sorry I am for any concern or frustration this may have caused. Making your homeownership journey as smooth as possible is our top priority, and we intend to make this right for you.”
Jay Bray
Chairman & Chief Executive Officer, Mr. Cooper Group
What Happened?
On October 31, 2023, Mr. Cooper detected suspicious activity in certain network systems. Immediately upon detection, we initiated response protocols, launched an investigation with the assistance of cybersecurity experts to determine the nature and scope of the incident, and contacted law enforcement. We also made the decision to shut down our systems to contain the incident and in an effort to protect our customers’ information. Through our investigation, we determined that there was unauthorized access to certain of our systems between October 30, 2023 and November 1, 2023. During this period, we identified that files containing personal information were obtained by an unauthorized party.

Frequently Asked Questions

Upon learning of this incident, we immediately took steps to identify and remediate it, including locking down our systems, changing account passwords, and restoring our systems. We initiated a detailed review to identify personal information contained in the impacted files as part of the incident. We are also monitoring the dark web and have not seen any evidence that the data related to this incident has been further shared, published, or otherwise misused.
You will receive a letter with details about any data of yours that was involved, along with resources you can use to protect your personal information.
You will receive a letter with details about any data of yours that was involved, along with resources you can use to protect your personal information, such as free TransUnion identity protection and credit monitoring services. In the meantime, if you have questions about this incident or identity protection services, call the Mr. Cooper Cyber Incident Response Line, supported by TransUnion at 1-833-960-4745.
To receive the free credit monitoring and identity protection services, please visit www.mytrueidentity.com and use the activation code provided in the letter you receive.
Mr. Cooper is actively monitoring the dark web and has not seen any evidence that the data related to this incident has been further shared, published, or otherwise misused. To help relieve concerns following this incident, Mr. Cooper is offering free identity protection and credit monitoring services through TransUnion. If Mr. Cooper’s investigation reveals that your personal data was exposed, you will receive a letter with details about any data of yours that was involved. The letter also includes resources you can use to protect your personal information, such as free identity protection and credit monitoring services. In the unlikely event that your information is misused, a personal advocate through TransUnion can work with you from the first call you make to report the problem until the crisis is resolved.
Investigations like this take time. We initiated response protocols immediately, which included a detailed review to determine exactly which data had been compromised. These reviews can be time consuming in order to ensure they are completely accurate and thorough. We appreciate your patience during this process.
We are offering free credit monitoring and identity protection services to any former or current (as of Oct. 31, 2023) Mr. Cooper customers or customers whose loans we service on behalf of our servicing partners. We are also monitoring the dark web and have not seen any evidence that the data related to this incident has been further shared, published, or otherwise misused. We are working to further enhance the security of our systems to help prevent incidents like this from happening in the future.
It is always best to be cautious when sharing any personal information over the phone. Mr. Cooper will never call you and ask for banking information or a Social Security number in order to validate your identity. If you’re ever uncertain that the person you’re speaking with is legitimate, hang up and contact your mortgage company directly. You can find their contact information on your billing statement.
Based on our investigation to date, roughly 14.7 million homeowners, representing former and current customers and co-borrowers, had personal information contained in the files that were affected by this incident.
Based on our investigation to date, of the total impacted population, a limited group of approximately 32,000 reverse mortgage customers’ bank account numbers were contained in the files that were affected by this incident. If your bank account number was involved, you will be sent a letter with details along with complimentary identity protection and credit monitoring services from TransUnion that we are providing to help protect your personal information going forward. If you do not have a reverse mortgage, your bank account number is not believed to have been involved in this incident. It is important to note that, typically, someone cannot access your financial account using a bank account number alone, which is why we believe any risk to financial information is low.
Mr. Cooper, formally known as Nationstar Mortgage LLC, is a mortgage originator and servicer. We support our own customers and customers of some of the largest mortgage companies in the United States. While you may not be familiar with the Mr. Cooper brand, your mortgage may have been serviced by Mr. Cooper in the past or they may be the servicing partner of your mortgage company.
question icon
Have more questions?
Call the Mr. Cooper Cyber Incident Response Line, supported by TransUnion.
Monday through Friday 8:00 a.m. to 8:00 p.m. ET
Phone
1-833-960-4745