The silence after the breach is the part you control

A ransomware group posts a lender’s name on a dark web leak site. Terabytes of loan files,  Social Security numbers, bank account details, employee records. The clock the public sees starts there. The clock that matters started weeks or months earlier, the day the intrusion was detected. And in the gap between those two moments, while the company says nothing, the most damaging part of the event is already underway. 

The mortgage industry has a breach problem. Since January, at least five nonbank lenders have disclosed prior hacks. One Long Island lender detected unauthorized network activity in  May 2025 and did not notify affected employees until March 2026, a delay a subsequent lawsuit puts at more than 260 days past the statutory deadline. These are not outliers. They are the pattern. 

But the breach itself is not the story worth telling. Lenders will keep getting attacked, because lenders hold exactly what attackers want. The story is what happens in the silence afterward,  and how much of that silence is a choice. 

The long tail of a loan file 

Start with what makes mortgage data uniquely toxic when it leaks. Lenders retain records for decades. When one large servicer was breached, the exposed data reached back to customers who had originated loans in 2001, people who had paid off their mortgages and had no reason to think the company still held their Social Security numbers. 

A breach at a mortgage company isn’t a snapshot of current customers. It is an archive. The 2024 loan file that funds a fraudulent application in 2027 is the same file sitting in the export a ransomware group just posted. 

That long tail is also a legal and reputational one. The moment data hits a leak site, the ecosystem activates. Plaintiffs’ firms file investigations within days. Claims aggregators stand up intake portals. State attorneys general open inquiries. One recent nonbank breach produced a settlement valued at more than $86 million. None of that resolves quickly. Rather than a one-day IT incident, a breach is a multi-year event that touches the balance sheet, the regulators and the brand, and it begins the moment the company goes quiet.

Here is where the silence becomes a choice. 

Forensics and notification run on different clocks 

The most common defense of a months-long delay is that the investigation was ongoing.  Forensics take time, the reasoning goes and you can’t notify people until you know what was taken. The first half of that is true. The second half is where companies get the sequence backward. 

Notification and forensic certainty run on two different clocks. Nearly every state breach notification statute triggers on discovery, when the organization knew or should have known,  not on the completion of the forensic report. The deadlines are tightening. 

California moved to a fixed 30 days from discovery as of January 2026 under SB 446, replacing a vaguer “without unreasonable delay” standard, and a growing number of states now run their clocks from the moment of discovery. Some make the point explicit, requiring notice to the state attorney general within the window even while the investigation is still ongoing. The law itself does not allow a company to wait for certainty. 

The cost of a shrinking window 

For a lender operating in 15 states, the obligation isn’t one clock but 15, each triggered at discovery, each running while the forensic picture is still developing. The honest operational answer is to build to the strictest combined standard and let counsel narrow it per incident, not to assemble the response under deadline pressure after the fact. 

A breach victim refreshing their bank statements doesn’t need the final forensic report. They need to know early that they may be exposed and what to do about it. Every day of silence is a day they don’t know to freeze their credit, and a day the company chooses silence, letting the story be written for them. By the time a polished, fully-investigated notification arrives months later, the narrative has already hardened: not “they were attacked,” but “they knew and said nothing.” 

Containing the breach is a security function. Communicating about it is a separate discipline,  on a separate timeline, and waiting for the security work to finish before beginning the communications work is the error that turns a bad week into a bad year. 

Building reputational defense before the breach 

The fix is not faster forensics. It is readiness built before the event. A company that has already worked through its breach scenarios, drafted its holding statements, mapped its notification obligations across every state it operates in and rehearsed who says what to whom is ready when the breach comes. It can put out a credible, responsible acknowledgment within hours of confirmation, while the forensic investigation proceeds in parallel. A company starting from zero at 11 p.m. on a Sunday cannot, and the hours it loses assembling a response are the hours the silence costs it most.

Reputational readiness is infrastructure. It belongs in the same category as the security controls and the legal review every serious lender already maintains, because the reputational exposure is as real as the regulatory one and far less defended. The breach you cannot prevent. The silence after it, you can. 

Mitch Cohen is the founder of ClearLine, a crisis communications readiness and response platform for mid-market organizations and the enterprises that serve and oversee them. He has 25 years of experience in strategic communications across fintech, data, and regulated industries.
This column does not necessarily reflect the opinion of HousingWire’s editorial department and its owners. To contact the editor responsible for this piece: [email protected].