WEI Mortgage LLC suffered a data breach resulting from a phishing attack that granted unauthorized access to employee email accounts between September 13 and September 28, 2017. The incident exposed sensitive personal information of affected individuals, including Social Security numbers, addresses, and names. The breach was disclosed to the California Office of the Attorney General on December 8, 2017. The attack exploited human vulnerability through deceptive emails, leading to credential compromise and subsequent unauthorized access to internal systems. While the exact number of impacted individuals was not specified, the exposure of Social Security numbers—a high-value target for identity theft—elevates the breach’s severity. The delay in detection (over two weeks) further increased the risk of misuse of the stolen data. The company’s response included reporting the incident to regulatory authorities, though details on mitigation measures (e.g., credit monitoring for victims) were not provided in the report. This incident underscores the persistent threat of phishing-based breaches targeting employee credentials, particularly in sectors handling financial and personal data, such as mortgage services.