A breach at financial-technology and services provider SitusAMC exposed corporate information and may have affected personal data connected to mortgage and financial-services customers. The incident was not reported as an outage or a confirmed compromise of banks’ online-banking and payment systems. Instead, it is a third-party data-exfiltration incident whose potential scope became clearer through breach notifications filed in 2026.
What happened at SitusAMC?
SitusAMC Holdings Corporation, a New York-based provider of technology and outsourced services for mortgage, commercial-real-estate and financial-services organizations, said it discovered unauthorized access to its systems on or about November 12, 2025.
As an Amazon Associate I earn from qualifying purchases.
In its initial account, SitusAMC said the intruder obtained corporate information associated with client relationships, including accounting records and legal agreements. The company also said some client-customer information might have been affected. It reported that the incident was contained, its services remained operational and no encrypting malware was involved. SitusAMC’s incident notice and contemporaneous reporting provide those details.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteA later Massachusetts filing said an unauthorized party acquired data from certain SitusAMC systems between November 12 and November 19, 2025. That filing identified potentially affected information that could include names, addresses, dates of birth and Social Security numbers.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The distinction matters: the public record supports a confirmed breach of a vendor environment and possible exposure of data tied to financial institutions and individuals. It does not establish that every SitusAMC system, every client or every bank customer was affected.
The timeline
- November 12, 2025: SitusAMC became aware of unauthorized access.
- November 12–19: A later state filing identified this as the period during which data was acquired from certain systems.
- November 16: Contemporary reporting said notifications began going to customers believed to be affected.
- November 22: SitusAMC publicly disclosed the incident and said customers had been informed.
- November 24–25: Reports said major financial institutions were assessing possible exposure.
- January 28, 2026: A Massachusetts notification identified 11,444 affected Massachusetts residents and listed possible personal-information categories.
- February 20: A California individual-notification template documented the continuing notice process and said fraudulent use was not known at that time.
- June 23: Bloomberg Law reported a $5.3 million settlement connected to litigation. The report should not be read as independently establishing final court approval or every settlement term.
Sources for the chronology include The Register’s reporting, the Massachusetts filing and the California notification template.
Which banks may be affected?
Reports citing sources familiar with the matter said JPMorgan Chase, Citigroup and Morgan Stanley were notified that information might have been exposed or were assessing potential exposure. That does not mean those banks’ entire customer bases were breached.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The available reporting does not establish how many customers at each institution were involved, whether the data related to active borrowers or former customers, or whether personal information was exposed for all three banks. It also does not establish that account credentials, payment-card data, balances or transaction records were taken.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Other categories of organizations connected to SitusAMC’s business include mortgage lenders, commercial-real-estate firms, investors, pension funds, state governments and other financial institutions. These are customer categories, not a confirmed list of victims. Axios and TechCrunch reported on the financial-sector response.
What information may have been taken?
Corporate and client-business records
SitusAMC initially referred to corporate information linked to client relationships, including:
- Accounting records
- Legal agreements
- Internal information associated with client relationships
- Potentially, loan, mortgage-servicing, real-estate or transaction documents
The exact contents depend on which client systems and repositories were accessed. Public information does not show that every listed category was present in every affected environment.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Individual personal information
The Massachusetts filing said potentially affected information could include names, addresses, dates of birth and Social Security numbers. The California notice used similar cautionary language and said SitusAMC was not aware of fraudulent use at the time of that notice.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
“May have been involved” does not mean every affected individual had every data element exposed. The notices also do not establish that bank passwords, PINs, card numbers, online-banking tokens or authentication secrets were included.
Was this a direct attack on bank accounts?
There is no public evidence in the supplied reporting that attackers accessed online-banking credentials, moved money or disrupted payment infrastructure. The FBI said at the time that it had identified no operational impact to banking services, while SitusAMC said its own services remained operational after containment.
That is different from saying the incident was harmless. Names, addresses, dates of birth, Social Security numbers and mortgage-related documents can help criminals create more convincing phishing messages, impersonate borrowers or employees, manipulate account-recovery processes, or target mortgage and identity-verification workflows.
Those are plausible abuse paths, not evidence that such fraud occurred in this incident. A data breach can create identity-theft and privacy risks without causing an immediate account takeover or service outage.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Why banks had to investigate a vendor breach
SitusAMC is not a consumer-facing bank. It operates as an intermediary that may process or store information for multiple financial-services clients. In simplified form, a data flow might look like:
Bank or lender → SitusAMC service environment → mortgage, loan, accounting, legal or borrower records
Actual architectures differ by client, product and business unit. A compromise at the intermediary can expose records connected to multiple institutions, but it does not automatically provide access to each institution’s production network.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
That concentration risk explains why banks had to assess the incident even when their own systems showed no compromise. Their investigations would typically need to determine which data was exchanged with SitusAMC, which portfolios or borrowers were connected to it, whether data was encrypted or tokenized, what logs showed, and whether notification obligations were triggered.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Those are standard incident-response questions; the public reports do not disclose each bank’s internal investigative process.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What financial institutions should learn
The incident illustrates why third-party risk cannot be managed solely through an annual questionnaire. Financial institutions should maintain a current inventory of critical vendors, the data each vendor holds and the downstream providers involved.
Questions for a breached vendor
- Which systems, tenants and repositories were accessed?
- What data was viewed, queried or copied?
- What is the confirmed acquisition or exfiltration window?
- Was data encrypted at rest and in transit, and were keys stored separately?
- Were privileged accounts, service accounts, application programming interface keys or remote-access credentials involved?
- Are relevant logs preserved and independently validated?
- What evidence rules out access to payment, authentication or account-management systems?
- Which subsidiaries, fourth parties and client environments were in scope?
- What customer-notification and remediation obligations apply?
Controls worth strengthening
- Minimize the data retained by outside providers and delete it when it is no longer needed.
- Require tenant isolation and least-privilege access.
- Use phishing-resistant multifactor authentication for vendor administrators and privileged staff.
- Require immutable logging and prompt access to evidence during an investigation.
- Put breach-notification deadlines, audit rights, forensic cooperation, cyber-insurance requirements and tested exit plans in contracts.
- Exercise both a vendor-outage scenario and a scenario in which the vendor remains operational while data has been exfiltrated.
Centralizing work with a specialist can improve efficiency and compliance, but it also creates concentration risk. Encryption can reduce the value of stolen files without eliminating risk if keys or readable application views are compromised. Replacing a vendor may reduce exposure but can create migration, service-disruption and data-transfer risks of its own.
Recommended Free Tools
What affected individuals should do
If you receive a formal SitusAMC or client-bank notice:
- Verify the notice independently. Visit the institution’s known website or call a number from an existing statement. Do not rely on unexpected links or phone numbers in an email.
- Activate offered monitoring. Use the service described in the official notice, such as the 24-month credit and CyberScan monitoring and identity-recovery services referenced in the Massachusetts notice.
- Review your credit reports. Look for unfamiliar accounts, inquiries, addresses or employment information.
- Consider a credit freeze. A freeze with Equifax, Experian and TransUnion can make it harder to open new credit in your name. A fraud alert is another option.
- Expect targeted impersonation. Be skeptical of callers claiming to be your bank, mortgage servicer or breach administrator.
- Protect authentication information. Never provide a one-time passcode, full password or remote access to an unsolicited caller.
- Report suspected identity theft. Use official government and financial-institution channels rather than paid intermediaries promising guaranteed recovery.
These precautions are appropriate because of the possible exposure of identity information; they do not indicate that fraudulent use has been established.
What remains unknown
- The total number of affected people nationwide.
- The complete list of affected SitusAMC clients and business units.
- The exact files and data elements taken.
- The initial access method and the attacker’s identity or motive.
- Whether any stolen information was misused.
- The final status, approval and terms of the reported settlement.
The most accurate description is therefore narrower than “banks were hacked”: a financial-services technology provider suffered unauthorized access and data acquisition, potentially exposing information connected to multiple institutions and individuals. The evidence does not show a confirmed compromise of banks’ core online-banking or payment systems, but it does show why vendor-held data can become a serious financial-sector and consumer-privacy problem.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
