Evolve Mortgage Services Hit by INC RANSOM Attack, Exposing Sensitive Financial Data Evolve Mortgage Services, a Texas-based provider of outsourced mortgage solutions to financial institutions, confirmed a data breach after detecting suspicious activity in its systems on September 24, 2025. A third-party investigation revealed unauthorized access occurred between September 17 and 24, 2025, with the INC RANSOM ransomware group claiming responsibility. The attackers alleged they exfiltrated 20 terabytes of data, including sensitive customer information such as Social Security numbers, client ID scans, addresses, phone numbers, and full credit histories dating back to 2016. The stolen data was posted on the dark web on October 30, 2025. While the breach involved names, Evolve has not publicly confirmed the full scope of exposed details. Evolve reported the incident to the California Attorney General on February 4, 2026, though the total number of affected individuals remains undisclosed. The company is offering 12 months of complimentary credit monitoring and identity protection via Cyberscout (a TransUnion subsidiary) to impacted parties, with enrollment required within 90 days of notification. The breach has prompted legal action, with Shamis & Gentile P.A., a class-action law firm, investigating potential compensation claims for those affected. Federal law entitles victims to free annual credit reports from major bureaus and options to place fraud alerts or credit freezes for added security.