2023-11-02 Mr. Cooper Group Inc. Cybersecurity Incident

Page last updated on April 11, 2024

Mr. Cooper Group Inc. initially disclosed a cybersecurity incident in an SEC 8-K filing on 2023-11-02 09:00:48 EDT.

Company Summary

Mr. Cooper Group Inc., formerly Nationstar Mortgage Holdings Inc., was founded in 1994 and is headquartered in the Dallas, Texas, area. Mr. Cooper Group is an umbrella corporation holding companies like Nationstar Mortgages, LLC, one of the largest mortgage servicers in the United States with a servicing portfolio of approximately $937 billion and more than 4.3 million customers, and Xome, an online real estate marketplace, among others.
Source: Wikipedia

Incident Details

Material: Unknown
Is Breach: TRUE
Records Compromised: 14,690,284
Data Types Impacted: Bank account number, Date of Birth, Social Security Number, Phone Number, Home address, Name

Compromised Date: 2023-10-30
Detected Date: 2023-10-31
Disclosure Date: 2023-11-02
Contained Date:
Recovered Date:

Attack Goal: Theft

Costs: $25M

• Aggregated costs (Direct): $25M - We are updating guidance for fourth quarter vendor expenses related to the incident to $25 million (from $5 to $10 million), which now includes an accrual for the cost of providing identity protection services for two years.

Filings

8-K filed on 2023-11-02

Mr. Cooper Group Inc. filed an 8-K at 2023-11-02 09:00:48 EDT
Accession Number: 0000933136-23-000097

Item 8.01 Other Events.

On October 31, 2023, Mr. Cooper Group Inc. (the “Company”) determined that the Company had experienced a cybersecurity incident in which an unauthorized third party gained access to certain technology systems. Following detection of the incident, the Company initiated response protocols, including deploying containment measures to protect systems and data and shutting down certain systems as a precautionary measure. The Company launched an investigation with assistance from leading cybersecurity experts and notified law enforcement.

While the Company’s investigation is ongoing, based on information currently known, the Company does not believe this incident will have a material adverse effect on its business, operations or financial results.

8-K/A filed on 2023-11-09

Mr. Cooper Group Inc. filed an 8-K/A at 2023-11-09 06:56:20 EST
Accession Number: 0000933136-23-000103

Explanatory Note.

This Current Report on Form 8-K/A (this “Current Report”) amends the Current Report on Form 8-K filed by Mr. Cooper Group Inc. (the “Company,” “we” or “our”) with the Securities and Exchange Commission (the “SEC”) on November 2, 2023 (the “Original Report”).

Item 8.01 Other Events.

On October 31, 2023, the Company determined that we had experienced a cybersecurity incident in which an unauthorized third party gained access to certain of our technology systems. Following detection of this incident, the Company initiated response protocols that included deploying containment measures involving shutting down certain systems as a precautionary measure. We have notified law enforcement, regulatory authorities, and other stakeholders, and we are working with our existing cyber security firms and retained additional cybersecurity experts to oversee our actions. Due to these and other measures, we believe we have contained the cyber threat.

We restarted servicing operations on Saturday, November 4, 2023, to include taking customer calls and payments, remitting to investors, and onboarding new loans. We expect our originations systems to be fully operational shortly, following reestablishment of connectivity with vendors and agencies, and we have already resumed buying Mortgage Servicing Rights (“MSRs”). Because our systems were not accessible from November 1 through November 4, many customers were unable to make payments or access their accounts. We announced to customers that they will not be subject to late fees, penalties or negative credit reporting related to late payments as a result of this incident.

We have initiated a thorough investigation to determine the cause and full extent of the incident. Our preliminary analysis found that certain customer data was exposed, however it will require additional analysis to validate this finding and quantify the scope and type of any such exposure.

While we cannot presently quantify the full extent of remediation and legal expenses associated with this cyber attack, we do not believe the impact will be material to our results of operations or financial conditions. We estimate fourth quarter earnings will include $5 to $10 million of additional vendor costs. Additionally, due to the precautionary shut-down of our systems, and the associated impact on operational revenues and expenses, we estimate that the originations segment will generate pretax operating earnings of $0 to -$10 million and that servicing segment will generate pretax operating earnings of $200 to $210 million, excluding MSR mark-to-market net of hedges. However, we expect that such operational impacts will be limited to fourth quarter.

8-K/A filed on 2023-12-15

Mr. Cooper Group Inc. filed an 8-K/A at 2023-12-15 07:01:51 EST
Accession Number: 0000933136-23-000109

Item 8.01 Other Events.

As previously disclosed, on October 31, 2023, the Company experienced a cybersecurity incident in which an unauthorized third party gained access to certain of our technology systems. Our forensic review, engagement with law forcement and regulators, and defense of litigation is ongoing. Additionally, our forensic review has determined that personal information relating to substantially all of our current and former customers was obtained from our systems during this incident. To assist our customers, we will offer complimentary identity protection services, including credit monitoring, to all of our current and former customers for two years. We are in the process of reaching out to customers with instructions on how to sign up for these complimentary services and how to contact us with questions.

We are updating guidance for fourth quarter vendor expenses related to the incident to $25 million (from $5 to $10 million), which now includes an accrual for the cost of providing identity protection services for two years. There is no change to our guidance for fourth quarter originations segment pretax operating earnings of $0 to -$10 million and servicing segment pretax operating earnings of $200 to $210 million excluding MSR mark-to-market net of hedges.

Company Information