South Carolina Joins $20 Million Multistate Data Breach Settlement with Nation’s Largest Nonbank Mortgage Servicing Company

Washington, D.C. — The State of South Carolina and 52 state financial regulatory agencies have taken coordinated action against mortgage company Bayview Asset Management LLC, and three of its affiliates, Lakeview Loan Servicing, Community Loan Servicing, and Pingora Holdings (collectively the Bayview Companies), for deficient cybersecurity practices and failing to comply with their examination authority following a data breach that impacted 5.8 million customers.

The $20 million settlement and corrective plan is the first collective multistate enforcement action by state regulators for a mortgage company data breach. The enforcement action underscores the importance of meeting state requirements to protect consumer data and complying with state supervisory demands.

“On behalf of the State Board of Financial Institutions, I am grateful for the work of the Consumer Finance Division, not only as an industry regulator but also as an advocate for South Carolina consumers,” said State Treasurer Curtis Loftis, who serves as board chairman. “While these lenders provide local citizens with funds for their financial needs, they must keep their borrowers’ personal financial information safe and secure. The Consumer Finance Division plays a vital role in working with these firms to encourage industry best practices and employ the latest technologies to prevent consumer exposure from the growing number of cybersecurity threats.”  

State regulators in California, Maryland, North Carolina, and Washington State led the multistate effort, which found that Bayview Companies’ information technology and cybersecurity practices did not meet federal or state requirements. Furthermore, the Bayview Companies delayed the supervisory process by failing to comply with state requests in a timely and complete manner in the early stages of the examination.

In addition to the monetary penalty, the Bayview Companies have agreed to take specified corrective actions, improve cybersecurity programs, undergo independent assessments, and provide three years of additional reporting to the states.

State financial regulators license and supervise more than 33,000 nonbank financial services companies through the Nationwide Multistate Licensing System (NMLS), including mortgage companies, money services businesses, consumer finance providers, and debt collectors.

South Carolina residents who have questions about the settlement should contact the SC Consumer Finance Division at 803-734-2020. Residents can also visit NMLS Consumer Access to verify that a company is licensed to do business in South Carolina, and they may also view past enforcement actions.