Impac Mortgage Faces Class Action Over Delayed Data Breach Notification A proposed nationwide class action lawsuit has been filed against Impac Mortgage Holdings, a residential mortgage lender based in Irvine, California, alleging negligence and delayed response following a data breach. The suit, led by plaintiff Monica P. Espejo of Anaheim, claims the company failed to implement adequate safeguards, including encryption and intrusion detection systems, to protect borrower data. The breach was first detected nearly two years before affected individuals were notified with letters mailed on March 27, 2026, according to court filings. The lawsuit estimates thousands of U.S. consumers were impacted, with damages exceeding $5 million under the Class Action Fairness Act. Legal claims include negligence, breach of implied contract, and violations of Section 5 of the Federal Trade Commission Act, which mandates timely breach response protocols. The case highlights growing scrutiny over lender data security practices, particularly the timing of breach notifications under state laws and the Gramm-Leach-Bliley Safeguards Rule. If a jury finds the two-year delay unreasonable, it could set a precedent for how plaintiffs’ attorneys approach future lender breaches. Impac has not yet responded to the allegations, and no court rulings have been issued. The company did not provide comment at the time of publication.

Impac Mortgage Holdings Data Breach Exposes Sensitive Customer Information Impac Mortgage Holdings, Inc., a California-based financial services company specializing in residential mortgage lending, is under investigation following a data breach that exposed sensitive personal information. The breach, detected on March 20, 2024, involved unauthorized access to company systems between February 21 and March 20, 2024. Impac Mortgage, founded in 1995 and formerly listed on the NYSE American under the ticker IMH, operates through subsidiaries like Impac Mortgage Corp., offering mortgage products such as Non-QM, Jumbo, and government-backed loans. The company has funded over $90 billion in loans since its inception but was delisted in 2024 due to financial compliance issues, now trading over-the-counter as IMPM. An investigation revealed that an unknown actor accessed files containing names and Social Security numbers of affected individuals. Impac Mortgage notified impacted parties via written notice on March 27, 2024. Legal firm Shamis & Gentile P.A. is now reviewing potential compensation claims for those affected by the breach.