Data breach notification for lenders runs on two tracks. Nonbank lenders and brokers under the FTC Safeguards Rule must notify the FTC within 30 days when unencrypted data on 500 or more consumers is taken. State laws separately require notice to affected residents, and sometimes to the attorney general. Preparing contacts, counts and templates beforehand saves days.
Which data breach notification rules apply to lenders?
Data breach notification rules for lenders come from two sources at once: a federal rule tied to the lender's regulator and the breach laws of each state where affected borrowers live. A nonbank lender or mortgage broker falls under the FTC Safeguards Rule. Banks and credit unions follow their own federal regulators instead.
A single incident can trigger several duties at the same time:
- The federal notice. For FTC-covered lenders, a report to the FTC when the incident meets the rule's definition and size.
- State notices to individuals. Each state's law decides what counts as personal information, what triggers notice and how fast it must go out.
- State notices to regulators. Some states also want a copy or a report sent to the attorney general.
- Contract notices. Wholesale lenders, investors, warehouse banks and vendors often require prompt notice under the agreements you signed.
The duties do not replace each other. Meeting the FTC deadline does not satisfy a state law, and a state notice to borrowers does not reach the FTC. Treat each one as its own task with its own owner.
The response plan that feeds all of this is part of the wider program described in the guide to the FTC Safeguards Rule for lenders and mortgage brokers.
The FTC deadline and contents of a lender data breach notice
The FTC requires a covered lender to report a notification event involving at least 500 consumers as soon as possible and no later than 30 days after discovery. A notification event is the unauthorized acquisition of unencrypted customer information. The report goes to the FTC electronically and covers who, what, when and how many.
The FTC's guide to the Safeguards Rule adds that reports may become public, and that the online form lets a company note when police have asked for a delay. The rule itself, at 16 CFR 314.4(j), the Safeguards Rule's notification paragraph, lists the contents:
- The lender's name and contact information.
- A description of the types of information involved.
- The date or date range of the event, if it can be determined.
- The number of consumers affected or potentially affected.
- A general description of the event.
- Whether a law enforcement official has determined in writing that public notice would impede an investigation or harm national security, with a way for the FTC to reach that official.
Law enforcement can buy time, within limits. An official may request an initial delay of up to 30 days, which can be extended by up to 60 more days on a written request. Longer delays need a determination by FTC staff.
Encryption changes the analysis. The trigger is unencrypted information, so statements that were encrypted and whose keys were not taken may fall outside the event. Write down why you reached that conclusion before relying on it.
State data breach notification duties toward borrowers
State data breach notification laws protect residents of the state regardless of which federal regulator oversees the lender. Each state defines personal information, sets the trigger, and decides how and when individuals are told. Some also require a report to the state attorney general once the breach passes a size threshold.
California is a useful example because many lenders have borrowers there. The California Attorney General's data breach reporting page explains that notice is required when unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. A business that must notify more than 500 California residents from a single breach must also submit a sample copy of the notice to the Attorney General electronically, with personal details removed.
Business files deserve attention here. A file for a business-purpose loan may fall outside the FTC's consumer count, yet the owner's Social Security number and personal statements are still a California resident's personal information under state law. Do not drop business files from the state analysis because they dropped out of the federal one.
Whatever the state requires, write the borrower notice for a reader who has never heard the word "exfiltration." Say what happened, which of their documents were involved, what you have done since and what they can do now, such as watching the accounts that appeared on their statements. Give a phone number or mailbox that a person answers.
With borrowers in many states, the work multiplies. Map affected people by state of residence first, then apply each state's rule. Outside counsel or a breach response firm usually holds a current state-by-state summary.
How do you count affected borrowers in a lender data breach?
Counting affected borrowers in a lender data breach means counting people, not files. One loan file can hold a borrower, a co-borrower, a guarantor, a spouse and family members named on statements. The count decides whether the FTC's 500-consumer line and any state thresholds are crossed, so it has to be right and documented.
Work through the file types that were exposed:
- Applications and loan files. Count every named applicant and co-applicant.
- Signers who are not borrowers. Spouses and guarantors who signed documents are people whose data is in the file. The ECOA spousal signature rule limits when a lender may ask for those signatures, but once collected, the data counts.
- Statements. A joint account statement names both holders.
- Declines and withdrawals. These files hold the same data as funded loans and are easy to forget.
- Duplicates. A repeat borrower with three files is still one person.
Your pipeline and loan systems are the fastest place to start. A current list of open and closed files, with status and borrower names, turns days of searching into hours. The practices in loan pipeline management for tracking files by stage also make it easier to reach borrowers whose loans are still in process.
A 30-day data breach notification timeline for a lending office
A 30-day data breach notification timeline for a lending office maps the work from discovery to the FTC deadline. The FTC clock starts at discovery, so the first days go to containment and scoping, the middle to counting and drafting, and the end to filing and sending notices.
The timeline below is an example. State deadlines may be shorter for some residents, and law enforcement may request a delay.
| Day | Task | Example owner |
|---|---|---|
| 0 | Discover the incident, start the response plan, preserve logs | Qualified Individual |
| 0 to 1 | Contain access, reset credentials, call counsel and insurer | IT lead, owner |
| 1 to 3 | Identify systems and file types exposed; confirm encryption status | IT lead |
| 2 to 5 | Notify partners required by contract | Owner |
| 3 to 10 | Count affected people and map them by state | Operations lead |
| 7 to 14 | Draft individual notices and any state regulator reports | Counsel |
| 10 to 20 | Set up a call line or mailbox for borrower questions | Operations lead |
| 14 to 25 | Send individual notices on each state's schedule | Counsel, operations |
| By 30 | File the FTC report if the event meets the rule | Qualified Individual |
Most of these steps are faster when prepared in advance. Before any incident, keep a contact list for counsel, your insurer and each contract partner, a current count of people in your files, a template notice reviewed by counsel, and a note on which systems encrypt data at rest.
Holding fewer statements also shrinks any future notice. Short retention in every system is the cheapest preparation. TrueBankFlow lets you set how long statements are kept after the underwriting report is exported, and keeps them encrypted in transit and at rest in the meantime.
Data breach notification mistakes lenders make after a leak
Data breach notification mistakes after a leak usually come from rushing or from waiting. Lenders send notices before they know what was taken, then send a second, different notice. Others wait for a perfect count and miss a deadline. Both damage trust more than the breach itself.
Patterns to avoid:
- Guessing the scope. A notice that says "no Social Security numbers were involved" and is later corrected is worse than a notice that waits two more days for the facts.
- Waiting for certainty. The FTC deadline runs from discovery. Gather facts in parallel with drafting.
- Forgetting the email copies. Statements in inboxes are often the exposed data. Search mail along with the loan system.
- Ignoring vendors. If a vendor was the source, its contract should require prompt notice to you. Your duty to notify still stands.
- Destroying evidence. Wiping a compromised laptop before logs are preserved makes scoping guesswork.
- No record of decisions. Write down why you concluded a notice was or was not required, especially when you relied on encryption.
After the notices go out, review what happened and change the program. The rule's incident plan includes evaluating and revising the plan after an event, and the review is where a lender usually learns that its statement intake, retention or access controls need work. The guide to secure document upload for lenders covers the intake fixes that most often follow.