New American Funding Listed by everest Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
New American Funding was listed by the everest ransomware group on July 15, 2025, after internal files were exfiltrated in a ransomware attack. The number of people affected is not known; anyone who has done business with the company should check their accounts and monitor for suspicious activity.
On July 15, 2025, New American Funding was listed by the everest ransomware group in connection with a claimed ransomware attack involving the exfiltration of internal files. The number of people affected is unknown, and public detail on the scale, timing, and precise method of the incident remains limited.
Because the organisation is a mortgage lender that routinely handles sensitive personal and financial records, any confirmed or claimed compromise of internal systems carries potential consequences for customers, employees, and partners even when the full extent of exposure has not been verified.
Breaking down the breach
Public reporting indicates that New American Funding appeared on the everest ransomware group’s leak site around July 15, 2025. The group claims that internal files were exfiltrated during a ransomware attack. No independent confirmation of the intrusion method, the date the systems were first accessed, the volume of data removed, or any ransom negotiations has been released. The number of individuals whose information may have been involved is listed as unknown. Beyond the group’s listing and the description of internal files being taken, further technical or forensic details have not been disclosed.
Who is everest?
Everest is a ransomware group that has operated for several years using a double-extortion model. In typical operations the group encrypts systems and simultaneously steals data, then threatens to publish the stolen material on a dedicated leak site if a ransom is not paid. The group has previously listed organisations across multiple sectors, including finance, manufacturing, and professional services. Listings on such sites constitute claims by the actors rather than independently Reported Facts; victims sometimes dispute the accuracy or completeness of the material the group asserts it holds. Public reporting has not confirmed that everest’s claims regarding New American Funding have been independently validated.
Who is New American Funding?
New American Funding is a family-owned mortgage lender with a nationwide presence. Founded in 2003, the firm provides a range of home-financing products that include FHA, VA, HARP, and conventional loans. Mortgage lenders of this type collect and store substantial volumes of personal and financial information in the ordinary course of underwriting, servicing, and compliance activities. A breach affecting such an organisation is consequential because the data it holds can be used for identity theft, loan fraud, or other financial crimes, and because the firm’s role in the housing market means any disruption or loss of trust can affect both individual borrowers and the broader lending process.
What data was at risk
The only data type named in connection with the incident is internal files said to have been exfiltrated in a ransomware attack. Exact file contents, categories of personal information, and the number of records involved have not been disclosed. Organisations in the mortgage sector typically maintain records that can include names, addresses, Social Security numbers, income and employment details, credit information, bank-account data, and loan-application documents. Whether any of those categories were present among the files claimed by everest remains unconfirmed.
The real-world impact
For individuals whose information may have been among the internal files, the primary risks include identity theft, fraudulent loan applications opened in their names, and targeted phishing that exploits knowledge of their mortgage or financial situation. These harms can take months or years to surface and often require ongoing monitoring of credit reports and financial accounts. For New American Funding the consequences can include regulatory scrutiny, notification costs, potential litigation, and damage to customer confidence. Because the number of people affected is unknown and the precise data types remain unconfirmed, the full scope of impact cannot yet be measured.
Were you affected?
If you have been a customer, employee, or partner of New American Funding, practical first steps include the following:
- Monitor credit reports and financial statements for unfamiliar activity.
- Place a fraud alert or credit freeze with the major credit bureaus if you believe your data may be involved.
- Be cautious of unsolicited communications that reference your mortgage or personal details.
- Retain any official notices the company may later issue regarding the incident.
Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. Public detail on this particular incident remains limited, so continued attention to official statements from the organisation is advisable.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Philadelphia Investment Partners Listed by everest Ransomware GroupGrayscale Investments Listed by everest Ransomware GroupNew American Funding - Full leak published Listed by everest Ransomware GroupBowles Womack & Company, P.C Listed by everest Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the New American Funding Listed by everest Ransomware Group →
Publicly posted by everest — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.