SitusAMC Data Breach Exposes Financial Records and Confidential Legal Documents

Retail finance firm SitusAMC confirmed a data breach on November 12, 2025. The incident compromised sensitive corporate data, including accounting records like invoices and legal agreements.

Some client customer information also faced risks. The company detected unusual activity and launched an investigation with third-party experts and federal law enforcement.

SitusAMC stressed that services remain fully operational. No encrypting ransomware disrupted operations.

The breach involved unauthorized access to specific file paths, now contained through quick fixes.

Breach Details and Impacted Data

The company split affected files into two main groups for review. Corporate files hold accounting documents, such as invoices, and legal contracts tied to client relationships.

Client files link to residential Collateral and Asset Management (CAM) services, mainly mortgage assignments and recordings.

A smaller set covers the loan file due diligence and other business records.

By November 25, keyword searches scanned compromised file paths for client names. This flagged potential matches without full content review.

E-discovery tools will refine results later. Not all files in a path belong to a single client deeper analysis is needed to confirm ownership.

Data Category	Description	Examples
Corporate Files	Accounting and legal records	Invoices, contracts
Client Files (CAM)	Residential mortgage-related	Assignments, recordings
Other Records	Loan due diligence, business files	Due diligence docs

Clients received letters listing relevant file paths. SitusAMC plans to set up a virtual data room for affected parties to access their files.

The full scope stays under investigation, with ongoing checks for more impacts.

Company Response and Security Measures

SitusAMC acted fast upon detection. Experts helped assess and contain the threat. Federal authorities got immediate notice, and cooperation continues.

Key hardening steps included resetting credentials to block reused passwords, turning off remote access tools favored by attackers, updating firewall rules to tighten network traffic, and strengthening security settings across systems.

Direct client outreach started right away, with updates on progress. No ransomware meant no data encryption scramble, aiding quick recovery.

This breach highlights risks in finance tech. Mortgage and legal data exposure could aid fraud if misused.

SitusAMC vows transparency, promising more alerts as reviews advance. Watch for client notifications amid the probe.