PennyMac Discloses Data Breach Affecting Nearly 4,000 Individuals Private National Mortgage Acceptance Company LLC, a subsidiary of mortgage lender PennyMac, reported a data breach impacting its Group Health Plan, exposing the protected health information (PHI) of 3,972 individuals in the U.S. The incident was disclosed to the U.S. Department of Health and Human Services (HHS) on June 9, 2026. PennyMac, which operates through entities like PennyMac Loan Services LLC, serves over 4 million customers nationwide. While the breach involved PHI under the Group Health Plan, the company has not publicly specified the exact types of data compromised. Affected individuals have been advised to contact PennyMac for further details and potential assistance. The breach underscores ongoing risks to sensitive health data within corporate benefit plans.

The California Office of the Attorney General reported a data breach involving PennyMac Loan Services LLC on August 28, 2023. The breach occurred on May 27, 2023, when unauthorized actors exploited a vulnerability in the MOVEit Transfer application used by the company, potentially exposing personal information of customers. The specific types of compromised information were not detailed in the report.