Impac Mortgage Holdings, Inc. detected unauthorized access to its systems on March 20, 2024, stemming from an incident that occurred between February 21, 2024, and March 20, 2024. The company began notifying affected individuals on March 27, 2026, nearly two years after the initial unauthorized access.
The breach exposed names, Social Security Numbers, dates of birth, addresses, government IDs, medical information, and financial information for 61,066 individuals. Regulatory bodies in California, Indiana, Maine, Massachusetts, New Hampshire, Oregon, Texas, and Vermont were notified of the incident. It remains unclear if other types of data were also affected.
Data breach details can emerge over time, and notifications may be delayed.