Skip to content
844-974-8669 Ask Zeus Book a call

Intelligence briefFall/Winter 2026/2027 Edition

SitusAMC breach moves to a $5.3 million settlement as vendor risk climbs

SitusAMC's 2025 data theft now has a proposed $5.3 million class settlement covering about 662,792 people, and third parties figured in 48 percent of breaches in the 2026 DBIR. Tier vendors by the data they hold.

Download the PDF, 774 KB Talk to the SOC

At a glance

BA-01 · Breach analysis

  • 662,792 People on the settlement class list[2]
  • $5.3M Proposed class settlement fund[1]
  • 48% Breaches involving a third party, 2026 DBIR[12]
  • 16,778 Claims filed as of September 14, 2026[3]
Status
Ongoing risk. A final approval hearing on the proposed class settlement is set for November 11, 2026, and no threat actor has been publicly identified in the sources reviewed.[1]
Incident
SitusAMC became aware of unauthorized access on or about November 12, 2025; its letters place the data acquisition between November 12 and November 21[7]
Attack type
Data theft; SitusAMC said no encrypting malware was involved[10]
Notified individuals
About 662,792 people on the settlement class list[2]
Litigation
In re SitusAMC Holdings Corporation Data Breach Litigation, No. 1:25-cv-9748 (S.D.N.Y.)[1]
Settlement
$5.3 million proposed; claims due November 6, 2026; final approval hearing November 11, 2026[1]
Attribution
None announced in the sources reviewed; the FBI said it was working with affected organizations[10]

What happened

SitusAMC, a New York real estate finance services vendor that its website says has more than 1,500 clients, said it became aware of unauthorized access to certain systems on or about November 12, 2025. Its investigation determined that an unauthorized third party acquired data from those systems, including corporate accounting records and legal agreements and, for notified borrowers, names, addresses, dates of birth, Social Security numbers, government identification numbers and financial account information. SitusAMC said no encrypting malware was involved and that its services remained fully operational.

  • Press reports citing people briefed on the incident named JPMorgan Chase, Citi and Morgan Stanley among notified clients; SitusAMC did not publicly confirm any client.
  • FBI Director Kash Patel told The New York Times the bureau was working with affected organizations and had found no operational impact on banking services.
  • FINRA alerted member firms to third-party and fourth-party exposure because banks that use SitusAMC are vendors to broker-dealers.
  • SitusAMC mailed notification letters in waves starting January 28, 2026, filed with the California Attorney General on four dates through April 3, 2026, and offered 24 months of IDX identity protection.
  • Related federal suits were consolidated in the Southern District of New York, and a $5.3 million class settlement covering about 662,792 people awaits a final approval hearing on November 11, 2026.
  • SitusAMC denies wrongdoing, and the court has not decided in favor of any party.

How it works

The attack as a living map, in kill-chain order from the first foothold to impact. Point at a step to light its wiring, click to pin its story.

at risk
  • entry
  • next step
  • impact

Read the attack chain

The threat on the left, each step in order, the people at risk on the right: point at a step to light its wiring, click to pin its story here.
00the attack chain
  • entry
  • next step
  • impact

Tap a node to read its story.

Step by step

  1. Initial access, not disclosed

    SitusAMC has not disclosed how the intruder got in. After the incident it said it reset credentials, disabled remote access tools, updated firewall rules and enhanced security settings.

  2. Access to internal systems

    SitusAMC detected unauthorized access to certain systems in its information technology network on or about November 12, 2025.

  3. Data acquired over about nine days

    The January 28, 2026 letter states that data was acquired between November 12 and 19, 2025. Letters filed from February 20, 2026 give November 13 to 21, 2025.

  4. No encryption, no public ransom note

    SitusAMC said no encrypting malware was involved. FINRA described the main goal as large-scale data theft for potential follow-on attacks or extortion, not malware deployment.

  5. Downstream fourth-party exposure

    FINRA warned that stolen corporate information, accounting records and legal agreements could be used to target broker-dealer customers through those firms' banking vendors that use SitusAMC.

Who is at risk

Any organization whose customer data sits with a vendor it does not directly monitor, and any firm whose own vendors use SitusAMC.

  • Banks and mortgage lenders that outsource loan fulfillment, due diligence, title, valuation or servicing work
  • Broker-dealers and advisers with fourth-party exposure through their banking vendors, as FINRA described
  • Pension funds and state governments, which FINRA listed as potentially impacted
  • Borrowers whose Social Security numbers, government identification numbers and financial account data were in the acquired files
  • SEC covered institutions, which under amended Regulation S-P must notify affected customers as soon as practicable and no later than 30 days after becoming aware of unauthorized access

Sectors in scope

  • Banking and mortgage lending
  • Real estate finance services
  • Broker-dealers with fourth-party exposure
  • Pension funds and state governments
04What changed

What changed since the last edition

Fall/Winter 2026/2027 Edition7 changes

  1. The court consolidated the related suits into In re SitusAMC Holdings Corporation Data Breach Litigation, No. 1:25-cv-9748, before Judge Lewis J. Liman, with Kelechian v. SitusAMC as the lead case filed November 24, 2025. A July 15, 2026 order records that the court granted consolidation on December 19, 2025 for all but one of eight listed cases; press counts of the consolidated suits vary.

    Source 4

  2. A $5.3 million class settlement was reported on June 26, 2026. National Mortgage News put the class at about 662,792 people, reported SitusAMC as not admitting wrongdoing or liability, and said a federal judge asked the parties for more information on the settlement administration budget.

    Source 2

  3. The court-authorized notice went out August 13, 2026. Opt-outs and objections are due October 22, 2026, claims are due November 6, 2026, and the final approval hearing is November 11, 2026 at 10:00 a.m. Benefits are up to $5,000 for documented losses, a flat payment estimated at $75, a $50 California payment and one year of credit monitoring with $1 million of identity theft insurance. The site states that SitusAMC denies doing anything wrong.

    Source 1

  4. SitusAMC's notification letters filed with the California Attorney General give the acquisition window as November 12 to 19, 2025 in the January 28, 2026 letter and November 13 to 21, 2025 in later letters. The January letter lists name, address, date of birth and Social Security number; the April 3, 2026 letter adds driver's license or other government identifiers and financial account numbers. Both offer 24 months of IDX monitoring.

    Source 8

  5. Claim uptake is low. Settlement Insight, reporting docket entries, put claims at 16,778 as of September 14, 2026, about 2.6 percent of a 657,845-person class list, with one objection and a fee request of $1,766,666.67 (one third of the fund) filed October 2, 2026.

    Source 3

  6. Verizon's 2026 Data Breach Investigations Report, as reported by Expert Insights, puts third-party involvement at 48 percent of confirmed breaches, up from 30 percent in the previous edition, across more than 22,000 breaches.

    Source 12

  7. The SEC's amended Regulation S-P is in force. It requires covered institutions to notify affected customers as soon as practicable and no later than 30 days after becoming aware of unauthorized access, and Sidley reports compliance dates of December 3, 2025 for larger entities and June 3, 2026 for smaller ones.

    Source 14

What to do now

In priority order, highest impact first.

  1. Do firstInventory every vendor and fourth party that holds customer personal data, and tier them by data sensitivity and volume.

    SitusAMC was invisible to most bank customers and to downstream broker-dealers until FINRA named the chain.

  2. Put prompt breach notification, cooperation and audit clauses into every vendor contract that touches customer data.

    SEC covered institutions must notify customers within 30 days of becoming aware, which is unworkable without fast vendor facts.

  3. Require phishing-resistant MFA on every vendor-facing and remote access path and review remote access tooling quarterly.

    SitusAMC said its response included credential resets and disabling remote access tools; check the same paths at your own vendors.

  4. Monitor critical vendors' external security posture continuously instead of relying on an annual questionnaire.

    Black Kite found 129 of 140 financial sector vendors, 92 percent, scored C, D or F for information disclosure in its 2025 report.

  5. Pre-build a vendor breach playbook with regulator and customer notification templates and documented alternate providers.

    The 2026 DBIR counts third parties in 48 percent of breaches, so a vendor incident is now the expected case.

  6. Verify vendor data minimization and segmentation in writing, and ask what customer data they retain after a transaction closes.

    SitusAMC's disclosures describe both corporate relationship files and borrower identifiers acquired in one incident.

  7. Brief leadership on the full cost chain of a vendor breach, not only the settlement fund.

    The $5.3 million fund is one line; 24 months of monitoring, notification, litigation and regulator engagement land on every party in the chain.

  8. Review the identity and Microsoft 365 posture that vendor-facing accounts live in.

    Z7 Solutions™ provides vendor risk assessments and a 24/7 SOC sized for mid-size financial and public sector organizations.

Sources

Every number and claim in this brief traces to a source below. Each source opens in a new tab at the publisher.

  1. [1]
    In re SitusAMC Holdings Corporation Data Breach Litigation, official settlement website (opens in a new tab) Settlement administrator for the U.S. District Court, S.D.N.Y. · Notice mailed August 13, 2026; accessed October 13, 2026 · samcdatasettlement.com
  2. [2]
    SitusAMC agrees to $5.3 million settlement over data breach (opens in a new tab) National Mortgage News · June 26, 2026 · nationalmortgagenews.com
  3. [3]
  4. [4]
  5. [5]
  6. [6]
    Data breach list entries for SitusAMC Holdings Corporation (opens in a new tab) California Office of the Attorney General · Entries dated January 28, February 20, March 10 and April 3, 2026 · oag.ca.gov
  7. [7]
    Notice of Data Breach letter dated January 28, 2026 (opens in a new tab) SitusAMC Holdings Corporation, filed with the California Attorney General · January 28, 2026 · oag.ca.gov
  8. [8]
    Notice of Data Breach letter dated April 3, 2026 (opens in a new tab) SitusAMC Holdings Corporation, filed with the California Attorney General · April 3, 2026 · oag.ca.gov
  9. [9]
    FINRA Cybersecurity Alert: SitusAMC Security Incident (opens in a new tab) FINRA · Undated on the page; the original edition cites December 1, 2025 · finra.org
  10. [10]
  11. [11]
  12. [12]
  13. [13]
  14. [14]
  15. [15]
    U.S. SEC Regulation S-P: Compliance Deadline Approaching for Smaller Entities (opens in a new tab) Sidley Austin LLP, Data Matters · April 30, 2026 · datamatters.sidley.com

Z7 Weekly Intelligence

One email a week: the threats that matter, new Z7 intelligence briefs and articles, and what to do about them. Unsubscribe anytime.

By subscribing, you agree to our Terms of Use. Our Privacy Policy explains how we use your email.

All Z7 Cyber Intelligence briefs
  • SP-03Spyware vendor ongoing risk

    Spyware vendors outlast sanctions and verdicts

    TakeawayPatch fast; treat Apple alerts as incidents.

    • 90 zero-days exploited in the wild in 2025
    • 110 countries in Apple's August 2026 spyware alert wave
    • Commercial spyware industry
    • Spyware vendor
    • Government officials and legislators
    PDF844 KB
  • TR-01Technology risk ongoing risk

    Post-quantum deadlines set, attack estimates fall

    TakeawayInventory your cryptography, turn on hybrid key exchange, and put PQC into every purchase.

    • Dec 31, 2030 federal deadline for PQC key establishment
    • 70% of browser traffic to Cloudflare uses hybrid ML-KEM
    • Technology risk
    • Federal agencies and contractors
    PDF843 KB
  • SP-02Spyware vendor ongoing risk

    Part 2 of 2

    Spyware vendors lead zero-days; Aladdin unconfirmed

    TakeawayPatch phones fast and harden browsers.

    • 15 of about 70 Google-documented zero-days attributed to Intellexa
    • 90 zero-days exploited in 2025, vendors ahead of state groups
    • Spyware vendor
    • Journalists and press freedom organizations
    PDF880 KB

Want this threat watched in your environment?

Talk to the team that runs the Z7 SOC about what this brief means for you. We will tell you what applies to your environment and what does not.

Talk to the SOCContact Z7 Call 844-974-8669
Ask Zeus AI assistant