The ransomware group Interlock has asserted that it acquired over 2.5 terabytes of data from NFM Lending around September 7, as reported by cybersecurity blogs and a proposed class-action lawsuit filed against the lender.
On the same day, the law firm Levi & Korinsky LLP published a notice on its website regarding the breach, stating that the case details are “still under investigation.”
The notice indicates, “On or about September 7, 2026, dark web monitoring sites such as Ransomware.live detected that the cybercriminal group Interlock claimed to have breached NFM Lending’s systems, as posted on their dark web leak site.”
According to Interlock, they have stolen over 2.5 terabytes of data, which includes customer Social Security numbers, financial account details, and possibly personal information of employees as well.
The incident has led to legal proceedings. Reports from Claim Depot indicate that on September 16, Sheneka Smith filed a proposed class-action lawsuit against NFM in the U.S. District Court for the District of Maryland. The complaint alleges that the breach has compromised customers’ names, Social Security numbers, and financial records.
The lawsuit, reviewed by HousingWire, states that NFM had not informed customers of the breach by the filing date, and the exact number of affected customers remains unknown. Smith claims this left impacted customers without the opportunity to take preventive measures like freezing their credit or flagging their accounts.
Furthermore, the complaint argues that NFM did not implement adequate cybersecurity measures or adequately train its employees on cyber risks.
“Based on available information, cybercriminals accessed Defendant’s systems due to inadequate employee training and insufficient security protocols to safeguard the Class’s Private Information,” the lawsuit states.
Smith expresses concern for her personal financial security and reports feeling “anxiety, stress, fear, and frustration.” She is seeking damages, restitution, injunctive relief, and attorney fees. The lawsuit includes claims for negligence, breach of implied contract, unjust enrichment, and violations of the Maryland Consumer Protection Act.
In a statement to HousingWire, NFM Lending’s legal department acknowledged that an unauthorized third party accessed certain IT systems. “We have taken immediate steps to secure our systems with the help of a third-party forensics team. At this point in the investigation, we cannot confirm how many individuals have been affected,” they stated.
“These lawsuits are designed to revictimize organizations like NFM Lending. They will not distract us from completing our investigation promptly. The security of our systems is our top priority, and we are treating this matter with the utmost seriousness. We are adhering to all protocols to ensure compliance with notification and credit protection measures for those impacted.”
Editor’s note: This article has been updated to include comments from NFM Lending.
