Borrowers whose information sat in MLD Mortgage loan files may be covered by proposed class actions alleging MLD Mortgage Inc., doing business as The Money Store, failed to protect that data before a September 2026 breach. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes class action complaints. The statements below are unproven allegations. MLD Mortgage Inc. has not been found liable, there is no certified class, and nothing to claim at this time. This page is informational and is not legal advice.
What Is This About?
MLD Mortgage Inc., the mortgage lender that does business as The Money Store, has been hit with at least five proposed class action lawsuits in federal court in New Jersey over a September 2026 data breach. The company says an unauthorized third party got into part of its network and took information from residential mortgage loan files.Four complaints were filed on October 9, 2026: two by the same plaintiff (Turner v. MLD Mortgage Inc., No. 2:26-cv-13238 and No. 2:26-cv-13218), plus Chavez v. MLD Mortgage Inc., No. 2:26-cv-13209, and Munoz v. MLD Mortgage Inc., No. 2:26-cv-13231. A fifth case, Jaiyeola v. MLD Mortgage Inc., No. 2:26-cv-13706, was filed on October 21, 2026, according to the court docket. Each case is at the complaint stage. MLD Mortgage has not responded in court, and none of the allegations has been proven.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Happened in the Breach
MLD Mortgage's notice letter, dated October 15, 2026 and filed with the California Attorney General, says the company identified unusual activity in its network on September 9, 2026. Its investigation found that, beginning on or about September 8, 2026, an unauthorized third party got into part of its environment through a remote monitoring and management platform used by a third-party service provider that supports its systems. The letter says the intruder "accessed and acquired" information from the affected systems and that federal law enforcement was notified.The files involved were residential mortgage loan files with origination, underwriting and closing documents. The specific data elements are filled in person by person in each letter, so the public sample does not list them. The letter does warn that borrowers who gave MLD Mortgage tax documents showing their dependents' names and Social Security numbers may have had that dependent information involved too.
MLD Mortgage is offering identity protection through IDX, including 12 or 24 months of credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy and identity theft recovery services. The enrollment deadline is January 15, 2027. The company has not published how many people were affected.
What the Lawsuits Claim
The October 9 complaints use nearly identical wording. They allege that a ransomware group called Storm added MLD Mortgage to its list of breach victims on or about September 22, 2026, and that the group took borrowers' information from the company's network. The complaints allege the exposed data included full names, contact information, Social Security numbers, financial account information, loan application details, income and employment records, property and mortgage documentation, and credit history. MLD Mortgage's own notice does not name Storm or describe the incident as ransomware.The plaintiffs claim MLD Mortgage did not use reasonable security for the sensitive, unencrypted information it kept and did not notify people promptly. All three complaint texts reviewed by OCA bring claims for negligence, negligence per se, unjust enrichment and breach of implied contract. They seek damages, restitution and other relief and demand a jury trial.
The proposed nationwide class is all persons whose private information was compromised in the breach. The Munoz complaint adds a California subclass and a claim under the California Consumer Privacy Act. It says the plaintiff sent the company the CCPA's required notice letter and may amend the complaint to seek statutory damages if the alleged violations are not cured within 30 days.
What Happens Next
When several suits over the same breach land in one court, the plaintiffs often ask to consolidate them into a single case with appointed lead counsel. MLD Mortgage would then answer or move to dismiss a consolidated complaint. As of October 21, 2026, none of that had happened. OCA will update this page if the cases are consolidated, dismissed or settled, or if MLD Mortgage discloses how many people were affected.Questions
Is MLD Mortgage the same company as The Money Store?
Yes. The notice letters and the lawsuits identify the company as MLD Mortgage Inc. doing business as The Money Store, a mortgage lender. The complaints quote the company describing itself as a family-owned, privately held lender serving homebuyers and homeowners across the country.
What information was in the files MLD Mortgage says were taken?
MLD Mortgage's notice says the affected files were residential mortgage loan files containing origination, underwriting and closing documentation, and that the unauthorized party accessed and acquired information from the affected systems. The specific data elements vary by person and are listed in each individual letter. The notice adds that dependents' names and Social Security numbers may be involved if borrowers supplied tax documents containing them during the loan process.
Who is Storm, and did MLD Mortgage confirm a ransomware attack?
The complaints allege that a ransomware group called Storm listed MLD Mortgage as a victim on its leak site on or about September 22, 2026. MLD Mortgage's notice does not name any group and does not use the word ransomware; it says an unauthorized third party got in through a remote monitoring and management platform used by a third-party service provider. The Storm listing is an allegation in the lawsuits, not a finding.
How many people were affected by the MLD Mortgage breach?
MLD Mortgage has not published a total. The notice filed with the California Attorney General does not state a count, and the complaints say only that the class includes thousands of people.
Is there an MLD Mortgage settlement or claim form?
No. The lawsuits were filed in October 2026 and no class has been certified. There is no settlement and no claim form. The free IDX identity protection offered in MLD Mortgage's notice letter is a company offer, separate from the lawsuits, with an enrollment deadline of January 15, 2027.
Sources
- California Attorney General data breach listing for MLD Mortgage Inc. dba The Money Store (breach dates September 8–9, 2026; reported October 15, 2026)
- MLD Mortgage sample notice letter, dated October 15, 2026
- Docket and complaint, Turner v. MLD Mortgage Inc., No. 2:26-cv-13238 (D.N.J. filed October 9, 2026)
- Docket and complaint, Turner v. MLD Mortgage Inc., No. 2:26-cv-13218 (D.N.J. filed October 9, 2026)
- Docket and complaint, Chavez v. MLD Mortgage Inc., No. 2:26-cv-13209 (D.N.J. filed October 9, 2026)
- Docket and complaint, Munoz v. MLD Mortgage Inc., No. 2:26-cv-13231 (D.N.J. filed October 9, 2026)
- Docket, Jaiyeola v. MLD Mortgage Inc., No. 2:26-cv-13706 (D.N.J. filed October 21, 2026)
