Interlock Ransomware Lawsuit Filed Against NFM Lending

Interlock, a cybersecurity firm, initiated a lawsuit against NFM Lending on March 12, 2024, alleging negligence following a ransomware attack that compromised the mortgage lender's systems. The lawsuit, filed in the U.S. District Court for the District of Maryland, claims that NFM Lending failed to implement adequate security measures, leading to a significant data breach. Interlock asserts that the attack resulted in the exfiltration of more than 2.5 terabytes of sensitive files, which included personal and financial information belonging to NFM Lending's customers and employees. The firm is seeking damages for the harm caused by the breach, including costs associated with remediation, notification, and potential identity theft protection for affected individuals.

The ransomware attack, which occurred in late 2023, disrupted NFM Lending's operations and raised concerns about the security of the data it handles. Interlock, which was reportedly engaged by NFM Lending to investigate the incident and assist with recovery efforts, claims that the lender's insufficient cybersecurity posture made it an easy target. The lawsuit details allegations of outdated software, inadequate access controls, and a lack of comprehensive data encryption as contributing factors to the breach's severity. Interlock's legal filing emphasizes that NFM Lending had a duty to protect the confidential information entrusted to it, and its failure to do so constitutes a breach of that duty.

According to the complaint, the compromised data potentially includes names, addresses, Social Security numbers, financial account details, and other personally identifiable information (PII) of thousands of individuals. Interlock argues that this exposure puts the affected parties at a high risk of identity theft and financial fraud. The lawsuit seeks to hold NFM Lending accountable for these potential harms and is requesting compensation for the damages incurred. Interlock's action highlights the increasing legal and financial risks associated with cybersecurity failures in the financial services sector, particularly for companies that handle vast amounts of sensitive customer data. The outcome of this lawsuit could set a precedent for how companies are held liable for data breaches resulting from alleged negligence.

NFM Lending, a national mortgage lender headquartered in Baltimore, Maryland, has not yet filed a formal response to the lawsuit. However, the company previously acknowledged a cybersecurity incident in late 2023, stating that it was working with third-party experts to investigate and secure its systems. The details of the breach and the extent of the data compromised were not fully disclosed at the time. The filing by Interlock provides a more specific account of the incident's scale and the alleged security lapses. This legal action underscores the critical importance of robust cybersecurity protocols and the significant consequences of failing to maintain them in today's digital landscape, especially within industries that manage sensitive personal and financial information.