Company Details
bayview-asset-management
998
25,326
52
bayview.com
0
BAY_1305127
In-progress

Bayview Asset Management, LLC Company CyberSecurity Posture
bayview.comBayview Asset Management, LLC (“Bayview”), initially founded in 1993, is a global alternative investment firm that provides flexible capital solutions while seeking to produce attractive risk-adjusted returns for its clients. Bayview’s investment platform benefits from connectivity to Bayview’s affiliated origination and servicing businesses, which provide market insights, data and analytics, and differentiated sourcing capabilities, allowing Bayview to invest through market cycles across the credit landscape. Bayview invests with a focus on residential, consumer, and commercial credit, including whole loans, credit risk transfer transactions, structured products, and mortgage servicing rights. With over 1,940 employees, Bayview is headquartered in Coral Gables, Florida. The firm has additional asset management offices in New York, London, Luxembourg, and Geneva, and loan servicing and origination affiliates in the U.S. and Milan, Italy. As of March 31, 2025, Bayview had $21.0 billion in assets under management.
Company Details
bayview-asset-management
998
25,326
52
bayview.com
0
BAY_1305127
In-progress
Between 700 and 749

BAML Global Score (TPRM)XXXX

Description: Bayview Asset Management and its affiliates (Community Loan Servicing, Lakeview Loan Servicing, and Pingora Loan Servicing) faced a **massive data breach in 2021**, exposing the **personal identifiable information (PII) of 5.8 million individuals**, including 2.5 million borrowers. The breach stemmed from negligent cybersecurity practices, leading to prolonged legal battles, regulatory penalties, and a **$20 million fine** imposed by over 50 state regulators. Plaintiffs alleged the company failed to protect sensitive data, resulting in lawsuits demanding damages and stricter security measures. The breach triggered a **class-action settlement**, marking the near-conclusion of a **3.5-year legal dispute**, with the company agreeing to comply with federal and New York DFS cybersecurity standards to prevent future incidents.


No incidents recorded for Bayview Asset Management, LLC in 2025.
No incidents recorded for Bayview Asset Management, LLC in 2025.
No incidents recorded for Bayview Asset Management, LLC in 2025.
BAML cyber incidents detection timeline including parent company and subsidiaries

Bayview Asset Management, LLC (“Bayview”), initially founded in 1993, is a global alternative investment firm that provides flexible capital solutions while seeking to produce attractive risk-adjusted returns for its clients. Bayview’s investment platform benefits from connectivity to Bayview’s affiliated origination and servicing businesses, which provide market insights, data and analytics, and differentiated sourcing capabilities, allowing Bayview to invest through market cycles across the credit landscape. Bayview invests with a focus on residential, consumer, and commercial credit, including whole loans, credit risk transfer transactions, structured products, and mortgage servicing rights. With over 1,940 employees, Bayview is headquartered in Coral Gables, Florida. The firm has additional asset management offices in New York, London, Luxembourg, and Geneva, and loan servicing and origination affiliates in the U.S. and Milan, Italy. As of March 31, 2025, Bayview had $21.0 billion in assets under management.


NN Group is an international financial services company, active in 10 countries, with a strong presence in a number of European countries and Japan. Our roots lie in the Netherlands, with a rich history of more than 175 years. With our 15,000 employees, NN Group provides retirement services, pensio

Built on a foundation of trust, integrity and promise, we proudly serve over 71,000 outstanding organizations and more than 17 million individuals. ¹ We take great pride in helping people with saving, investing and advice, while providing them with the tools and resources they need to help reach the

SM Investments Corporation is a leading Philippine company that is invested in market-leading businesses in retail, banking, and property. It also invests in ventures that capture high growth opportunities in the emerging Philippine economy. SM’s retail operations are the country’s largest and most

At Chase, we’re dedicated to helping you succeed. Whether you’re in need of banking, credit cards, mortgages, auto financing, investment guidance, small business support, or payment solutions, we’re beside you every step of the way. For customer service, contact us via chase.com/customerservice. S
Imagine a world where people live healthier, more enhanced and protected lives… A world in which each organisation is a powerful influencer and responsible corporate citizen, committed to being a force for social good. As a leading innovator in healthcare, wellness, insurance, investments, financial

Bienvenido a la página oficial del Banco BBVA Bancomer. Institución financiera de México desde 1932. Es una empresa filial de Banco Bilbao Vizcaya Argentaria (BBVA), uno de los grupos financieros líderes en Europa y considerado entre uno de los más grandes de la Zona Euro. El Grupo trabaja por un f
The Allianz Group is one of the world's leading insurers and asset managers with more than 100 million private and corporate customers in more than 70 countries. We are proud to be the Worldwide Insurance Partner of the Olympic & Paralympic Movements from 2021 until 2028 and to be recognized as one

Dubai Holding is a diversified global investment company that continues to power Dubai’s growth across 10 key sectors, including real estate, hospitality, leisure & entertainment, media, ICT, design, education, retail, manufacturing & logistics and science. Since 2004, we have made strides with an

MUFG (Mitsubishi UFJ Financial Group) is one of the world's leading financial groups. Headquartered in Tokyo and with over 360 years of history, MUFG has a global network with over 2,100 locations in more than 40 markets including the Americas, Europe, the Middle East and Africa, Asia and Oceania. T
.png)
Bayview MSR Opportunity Master Fund, L.P. managed by Bayview Asset Management, LLC agreed to acquire Guild Holdings Company from McCarthy...
Bayview's MSR Fund completes its $20.00-per-share, $1.3B all-cash purchase of Guild Holdings, taking GHLD private and pairing Guild with...
Asset to undergo full renovation and rebrand as a Gurney's Resort as Part of Ongoing Growth Plan. BLDG Management and Metrovest Equities...
Guild Holdings Company (NYSE: GHLD), a growth-oriented mortgage company that employs a relationship-based loan sourcing strategy to execute...
The Schall Law Firm, a national shareholder rights litigation firm, announces that it is investigating claims on behalf of investors in...
It has signed a definitive agreement under which a fund managed by Bayview Asset Management, LLC (Bayview) will acquire all of the outstanding shares of the...
Learn about recent privacy and security laws for February 2025 from the state and federal level as well as from the European Union including...
BALTIMORE, MD—Bayview Asset Management, LLC, a mortgage company, and three of its affiliates have agreed to a $20 million settlement with 53...
Arkansas has joined a $20 million settlement with Bayview Asset Management over cybersecurity failures that affected 5.8 million customers.

Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
The official website of Bayview Asset Management, LLC is http://www.bayview.com.
According to Rankiteo, Bayview Asset Management, LLC’s AI-generated cybersecurity score is 723, reflecting their Moderate security posture.
According to Rankiteo, Bayview Asset Management, LLC currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
According to Rankiteo, Bayview Asset Management, LLC is not certified under SOC 2 Type 1.
According to Rankiteo, Bayview Asset Management, LLC does not hold a SOC 2 Type 2 certification.
According to Rankiteo, Bayview Asset Management, LLC is not listed as GDPR compliant.
According to Rankiteo, Bayview Asset Management, LLC does not currently maintain PCI DSS compliance.
According to Rankiteo, Bayview Asset Management, LLC is not compliant with HIPAA regulations.
According to Rankiteo,Bayview Asset Management, LLC is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Bayview Asset Management, LLC operates primarily in the Financial Services industry.
Bayview Asset Management, LLC employs approximately 998 people worldwide.
Bayview Asset Management, LLC presently has no subsidiaries across any sectors.
Bayview Asset Management, LLC’s official LinkedIn profile has approximately 25,326 followers.
Bayview Asset Management, LLC is classified under the NAICS code 52, which corresponds to Finance and Insurance.
No, Bayview Asset Management, LLC does not have a profile on Crunchbase.
Yes, Bayview Asset Management, LLC maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/bayview-asset-management.
As of December 04, 2025, Rankiteo reports that Bayview Asset Management, LLC has experienced 1 cybersecurity incidents.
Bayview Asset Management, LLC has an estimated 29,885 peer or competitor companies worldwide.
Incident Types: The types of cybersecurity incidents that have occurred include Breach.
Detection and Response: The company detects and responds to cybersecurity incidents through an remediation measures with agreed to comply with federal and new york state department of financial services cybersecurity standards post-breach, and communication strategy with public notices issued by lakeview loan servicing (2022-03)..
Title: Bayview Asset Management Data Breach (2021)
Description: Bayview Asset Management and three affiliates (Community Loan Servicing, Lakeview Loan Servicing, and Pingora Loan Servicing) experienced a data breach affecting 5.8 million people between October 27, 2021, and December 7, 2021. The breach exposed personally identifiable information (PII) of borrowers, leading to a class-action lawsuit and a $20 million regulatory penalty. The parties have agreed to a settlement, subject to court approval, marking the near-conclusion of a three-and-a-half-year legal battle.
Date Publicly Disclosed: 2022-03
Type: Data Breach
Common Attack Types: The most common types of attacks the company has faced is Breach.

Data Compromised: Personally identifiable information (pii)
Customer Complaints: Multiple lawsuits filed by dozens of plaintiffs
Brand Reputation Impact: Significant (legal battles, regulatory penalties, public disclosures)
Legal Liabilities: $20 million regulatory penalty (led by California, Maryland, North Carolina, and Washington state regulators)
Identity Theft Risk: High (PII of 5.8 million people exposed)
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Personally Identifiable Information (PII).

Entity Name: Bayview Asset Management
Entity Type: Financial Services
Industry: Asset Management / Loan Servicing
Customers Affected: 5.8 million

Entity Name: Community Loan Servicing
Entity Type: Subsidiary
Industry: Loan Servicing
Customers Affected: Included in 5.8 million

Entity Name: Lakeview Loan Servicing
Entity Type: Subsidiary
Industry: Loan Servicing
Customers Affected: 2.5 million (subset of 5.8 million)

Entity Name: Pingora Loan Servicing
Entity Type: Subsidiary
Industry: Loan Servicing
Customers Affected: Included in 5.8 million

Remediation Measures: Agreed to comply with federal and New York State Department of Financial Services cybersecurity standards post-breach
Communication Strategy: Public notices issued by Lakeview Loan Servicing (2022-03)

Type of Data Compromised: Personally Identifiable Information (PII)
Number of Records Exposed: 5,800,000
Sensitivity of Data: High
Data Exfiltration: Yes
Personally Identifiable Information: Yes (borrower PII)
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Agreed to comply with federal and New York State Department of Financial Services cybersecurity standards post-breach.

Regulations Violated: Federal cybersecurity standards, New York State Department of Financial Services standards,
Fines Imposed: $20,000,000 (imposed in January 2024 by multi-state regulators)
Legal Actions: Class-action lawsuit filed by dozens of plaintiffs (March 2022), Most claims dismissed by judge (December 2023), Settlement agreement reached (2024, subject to court approval), Multi-state regulatory action (led by California, Maryland, North Carolina, Washington),
Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through Class-action lawsuit filed by dozens of plaintiffs (March 2022), Most claims dismissed by judge (December 2023), Settlement agreement reached (2024, subject to court approval), Multi-state regulatory action (led by California, Maryland, North Carolina, Washington), .

Recommendations: Enforce cybersecurity measures to comply with federal and NY DFS standards (as per regulatory agreement)
Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Enforce cybersecurity measures to comply with federal and NY DFS standards (as per regulatory agreement).

Source: Court document (settlement filing)

Source: DBR Law, P.A. complaint (on behalf of California plaintiff)

Source: Public notices by Lakeview Loan Servicing (2022-03)

Source: Multi-state regulatory action announcement (January 2024)
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Court document (settlement filing), and Source: DBR Law, P.A. complaint (on behalf of California plaintiff), and Source: Public notices by Lakeview Loan Servicing (2022-03), and Source: Multi-state regulatory action announcement (January 2024).

Investigation Status: Settlement agreed (subject to court approval); formal agreement to be filed within 45 days (as of 2024)
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public notices issued by Lakeview Loan Servicing (2022-03).

Customer Advisories: Public notices issued by Lakeview Loan Servicing (2022-03)
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: was Public notices issued by Lakeview Loan Servicing (2022-03).

Root Causes: Flaws in cybersecurity handling (as cited by regulators)
Corrective Actions: Agreed to comply with federal and NY DFS cybersecurity standards
Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Agreed to comply with federal and NY DFS cybersecurity standards.
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2022-03.
Most Significant Data Compromised: The most significant data compromised in an incident were Personally Identifiable Information (PII) and .
Most Sensitive Data Compromised: The most sensitive data compromised in a breach was Personally Identifiable Information (PII).
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 5.8M.
Highest Fine Imposed: The highest fine imposed for a regulatory violation was $20,000,000 (imposed in January 2024 by multi-state regulators).
Most Significant Legal Action: The most significant legal action taken for a regulatory violation was Class-action lawsuit filed by dozens of plaintiffs (March 2022), Most claims dismissed by judge (December 2023), Settlement agreement reached (2024, subject to court approval), Multi-state regulatory action (led by California, Maryland, North Carolina, Washington), .
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Enforce cybersecurity measures to comply with federal and NY DFS standards (as per regulatory agreement).
Most Recent Source: The most recent source of information about an incident are Public notices by Lakeview Loan Servicing (2022-03), Multi-state regulatory action announcement (January 2024), DBR Law, P.A. complaint (on behalf of California plaintiff) and Court document (settlement filing).
Current Status of Most Recent Investigation: The current status of the most recent investigation is Settlement agreed (subject to court approval); formal agreement to be filed within 45 days (as of 2024).
Most Recent Customer Advisory: The most recent customer advisory issued was an Public notices issued by Lakeview Loan Servicing (2022-03).
.png)
MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. Prior to 2.9.8, there is a security issue exists in the exec_in_pod tool of the mcp-server-kubernetes MCP Server. The tool accepts user-provided commands in both array and string formats. When a string format is provided, it is passed directly to shell interpretation (sh -c) without input validation, allowing shell metacharacters to be interpreted. This vulnerability can be exploited through direct command injection or indirect prompt injection attacks, where AI agents may execute commands without explicit user intent. This vulnerability is fixed in 2.9.8.
XML external entity (XXE) injection in eyoucms v1.7.1 allows remote attackers to cause a denial of service via crafted body of a POST request.
An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to access administrative functions of the device (e.g. file upload, firmware update, reboot...) via a crafted authentication bypass.
Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a TOTP code is provided, potentially gaining unauthorized access to user accounts. This issue exists due to problematic conditional logic in the authentication flow. This vulnerability is fixed in 5.9.8.
Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service. Small numbers go through this call stack: NativeNumber.numTo > DToA.JS_dtostr > DToA.JS_dtoa > DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous power. This vulnerability is fixed in 1.8.1, 1.7.15.1, and 1.7.14.1.

Get company history
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.