Berkadia Faces Lawsuit Over Massive Data Breach Linked to ShinyHunters A proposed class-action lawsuit has been filed against commercial mortgage servicer Berkadia, alleging the company suffered a major data breach that exposed highly sensitive personal and financial information. The breach, attributed to the cybercriminal group ShinyHunters, reportedly compromised a vast trove of data, including: - Full names, Social Security numbers, and dates of birth - Home addresses and email addresses - Driver’s license and passport numbers - Employment credentials, work histories, and banking details - Sensitive business documents and tax information The lawsuit claims Berkadia’s cybersecurity measures fell short of industry standards, violating both the NIST Cybersecurity Framework and the Center for Internet Security’s Critical Security Controls benchmarks cited as mandatory for financial services firms. Additionally, the complaint highlights discrepancies between Berkadia’s stated privacy policy, which promises robust safeguards, and the alleged lack of effective protections at the time of the breach. Of particular concern is the company’s delayed response. More than three weeks after the incident, the suit alleges Berkadia had not notified affected individuals, reported the breach to state attorneys general, or provided identity theft monitoring. The plaintiff, Todd, is seeking compensatory damages, reimbursement for out-of-pocket costs, injunctive relief (including mandatory security upgrades and annual audits), and at least 10 years of credit monitoring for impacted parties. The lawsuit estimates damages exceeding $5 million. No ruling has been issued, and Berkadia has yet to respond to the allegations.