California Regulator Fines Mortgage Company $825K Over 2023 Ransomware Breach On August 13, the California Department of Financial Protection and Innovation (DFPI) issued a consent order against a Utah-based mortgage company, imposing an $825,000 penalty for failing to safeguard the personal data of over 284,000 individuals including more than 34,000 California residents. The breach, which occurred in March 2023, involved a threat actor infiltrating the company’s network, deploying malware, stealing employee credentials, and disabling security systems before launching a ransomware attack. A DFPI examination revealed systemic cybersecurity and governance failures predating the incident. Key deficiencies included: - Inadequate risk assessments from 2021 to 2023. - No formal cybersecurity audits between 2017 and 2023. - Weak vulnerability and patch management, poor access controls, and an incomplete asset inventory. - Lack of documented remediation for issues identified in penetration testing. - Insufficient board-level oversight and strategic planning. The DFPI also determined the company failed to produce a written forensic report detailing the breach’s root cause or corrective actions. These lapses violated the Gramm-Leach-Bliley Act (GLBA) Safeguards Rule, California Civil Code § 1798.100(e), and the state’s Residential Mortgage Lending Act. Under the consent order accepted without admission of wrongdoing the company must pay the fine, provide affected California borrowers with 12 months of free identity theft insurance, and immediately rectify its recordkeeping and cybersecurity practices.