Arkansas Securities Department joins $20 million multistate data breach settlement with nation’s largest nonbank servicing company

Arkansas Securities Department joins $20 million multistate data breach settlement with nation's largest nonbank servicing company

LITTLE ROCK, Ark. (January 8, 2025) - The Arkansas Securities Department and 52 state financial regulatory agencies have taken coordinated action against mortgage company Bayview Asset Management LLC and three of its affiliates, Lakeview Loan Servicing, Community Loan Servicing, and Pingora Holdings (collectively the Bayview Companies), for deficient cybersecurity practices and failing to comply with their examination authority following a data breach that impacted 5.8 million customers.

The $20 million settlement and corrective plan is the first collective multistate enforcement action by state regulators for a mortgage company data breach. The enforcement action underscores the importance of meeting state requirements to protect consumer data and complying with state supervisory demands.

"This settlement demonstrates that appropriate cybersecurity measures designed to protect consumers' confidential information are a paramount requirement for regulated financial institutions in Arkansas," said Securities Commissioner Susannah T. Marshall. "This Order sets a precedent for all licensees and ensures that the Bayview Companies will adopt new corporate policies and data security processes to deter data breaches like this one in the future."

State regulators in California, Maryland, North Carolina, and Washington State led the multistate effort, which found that Bayview Companies' information technology and cybersecurity practices did not meet federal or state requirements. Furthermore, the Bayview Companies delayed the supervisory process by failing to comply with state requests in a timely and complete manner in the early stages of the examination.

In addition to the monetary penalty, the Bayview Companies have agreed to take specified corrective actions, improve cybersecurity programs, undergo independent assessments, and provide three years of additional reporting to the states.
State financial regulators license and supervise more than 33,000 nonbank financial services companies through the Nationwide Multistate Licensing System (NMLS), including mortgage companies, money services businesses, consumer finance providers, and debt collectors.

Arkansas residents who have questions about the settlement should contact the Arkansas Securities Department at www.securities.arkansas.gov or at 800-981-4429. Residents can also visit NMLS Consumer Access to verify that a company is licensed to do business in Arkansas, and they may also view past enforcement actions.