Academy Mortgage Corporation Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Academy Mortgage Corporation, a national mortgage lender headquartered in Draper, Utah, was listed by the alphv ransomware group in a claim reported on March 21, 2023. Public detail remains limited: the number of people affected is unknown, and the only description of what was taken is that internal files were allegedly exfiltrated in a ransomware attack. The listing itself is a claim by the group and has not been independently confirmed in the available record.

For customers, employees, and partners of a direct mortgage lender, any confirmed exposure of internal files can carry lasting practical consequences. What is known so far is narrow; what matters is understanding the claim, the actor behind it, and the concrete steps people can take while fuller details stay undisclosed.

Inside the incident

According to the reported information, Academy Mortgage Corporation appeared on an alphv-associated listing dated March 21, 2023. The claim states that internal files were exfiltrated in a ransomware attack. No public figure has been given for the number of individuals affected. Timing of the intrusion, the initial access method, the duration of any unauthorized presence, and the precise volume or categories of files taken beyond the general label “internal files” are all undisclosed.

No dollar amount, ransom demand, or confirmation of payment appears in the available facts. There is likewise no public statement in the record from the company detailing containment, notification timelines, or forensic findings. The incident is therefore known primarily through the group’s claim of a listing and the associated assertion of data theft, rather than through a fully documented disclosure.

The group behind it: alphv

Alphv, also widely tracked in public reporting as BlackCat, is a ransomware operation that has functioned as a ransomware-as-a-service (RaaS) offering. Affiliates gain access to victim environments, deploy the encryptor, and typically pursue double extortion: encrypting systems while also copying data and threatening to publish or sell it if payment is not made. The group has been associated with a custom ransomware strain written in Rust, which has allowed relatively rapid adaptation across Windows and Linux targets, and with leak sites used to pressure victims by naming them and, in some cases, releasing samples of stolen material.

Public tracking of alphv activity has linked the brand to numerous corporate and institutional victims across sectors before and around the period of this listing. The group’s model relies on the credibility of its leak-site claims; those claims are assertions by the actors, not verified inventories. In this case, the facts state only that Academy Mortgage Corporation was listed and that internal files were described as exfiltrated. No further specific statements by alphv about this victim—such as file counts, sample dumps, or deadlines—are provided in the record, and none should be assumed.

About Academy Mortgage Corporation

Academy Mortgage Corporation is described as a family-owned mortgage company founded in 1988 and based in Draper, Utah. It operates as a direct lender, handling underwriting and funding in house, and offers both purchase mortgages and refinance loans. The company originated more than $15.65 billion in loans in 2021. It maintains over 350 branch offices across the country and is licensed to originate loans in 49 states. Duane is identified as the principal owner and founder.

Organizations in this sector routinely process large volumes of highly sensitive personal and financial information in the ordinary course of originating and servicing loans. A ransomware incident that includes claims of internal-file theft is therefore consequential not only for operational continuity but for the privacy and financial security of borrowers, applicants, employees, and counterparties whose data may reside in those systems. The scale of a national direct lender amplifies the potential reach of any confirmed exposure, even when exact counts remain unknown.

What data was at risk

The facts name the exposed material only as “internal files exfiltrated in ransomware attack.” No further breakdown—such as customer loan files, Social Security numbers, bank account details, employee records, or internal credentials—is provided. Exact contents are therefore unconfirmed.

Mortgage lenders of this type typically hold, among other records, loan applications, credit and income documentation, property and appraisal data, government identification details, contact information, and servicing histories. They also maintain internal corporate files, correspondence, and system data. Whether any of those categories were among the files the group claims to have taken is not established in the public record. Readers should treat specific data-type assertions beyond “internal files” as unverified unless and until official notification or a fuller disclosure appears.

What's at stake

For individuals, the core risks are identity theft, financial fraud, and targeted phishing that exploits knowledge of a mortgage or refinance relationship. Even partial internal files can contain enough personal and financial detail to support account takeover attempts or social-engineering attacks against banks, employers, or family members. Because the number of people affected is unknown, anyone who has done business with Academy Mortgage, worked for the company, or shared documents in a loan process has reason to remain alert until clearer scope information emerges.

For the organization, stakes include regulatory notification duties, potential civil exposure, reputational harm, and the cost of investigation, remediation, and customer support. Ransomware incidents can also disrupt loan origination and servicing operations. None of these outcomes is confirmed as having occurred solely from the listing; they are the ordinary consequences that follow when internal files are credibly alleged to have left an institution’s control.

If your data was in this claimed breach

Public detail on who was affected is limited, so treat the following as prudent baseline steps rather than confirmation that your information was involved:

• Monitor credit reports and financial accounts for unexpected inquiries, new accounts, or transactions; consider a fraud alert or credit freeze with the major credit bureaus if you have an existing or recent relationship with the company.
• Be skeptical of unsolicited calls, emails, or texts that reference a mortgage, refinance, or “breach assistance,” and verify any outreach through official channels you already trust.
• Change passwords on related financial and email accounts, and enable multi-factor authentication where available.
• Retain any official notice you later receive from Academy Mortgage or regulators; it will supersede general guidance.
• You can run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets.

If you receive a formal notification naming specific data elements, follow the instructions in that notice and consider consulting the Federal Trade Commission’s identity-theft resources or a trusted consumer-protection agency for next steps tailored to what was confirmed.

AICompiled with AI assistance from public sources and published under our editorial standards.