MLD Mortgage Inc., doing business as The Money Store, mailed a notice dated October 15, 2026. The California sample and the Massachusetts copy (notice 2026-1802) use the same account of the incident. On September 9, 2026, the company identified unusual activity. The investigation found that, beginning on or about September 8, 2026, an unauthorized party accessed part of the environment through a remote monitoring and management platform used by a third-party service provider. The letter says that party accessed and acquired information from the affected systems. The company notified federal law enforcement. The letter does not name the remote-monitoring product or the provider.
Snapshot
| Field | Detail |
|---|---|
| Company | MLD Mortgage Inc. dba The Money Store |
| Letter date | Oct 15, 2026 |
| Access window in the letter | On or about Sept 8, 2026; unusual activity identified Sept 9 |
| Path in the letter | Vendor remote monitoring and management platform |
| What the files were | Residential mortgage files: origination, underwriting, closing |
| IDX deadline | Jan 15, 2027 · 1-866-200-0951 |
The published samples leave the field-by-field list as a blank. AcidPeak reads the state filings as names, Social Security numbers, driver’s license and other government ID numbers, financial account information, medical information, and dates of birth, and it reports 1,367 Texas residents, 1,248 Massachusetts residents, and 45,561 people in total. Those counts are the filings as AcidPeak compiled them. The letter itself says dependents’ names and Social Security numbers on tax documents given during origination may also have been involved.
The Massachusetts copy offers 24 months of IDX credit and CyberScan monitoring, a $1 million reimbursement policy, and managed identity recovery. The California sample still shows a placeholder where that term length sits. Enrollment is at app.idx.us/account-creation/protect or 1-866-200-0951, deadline January 15, 2027. The company address on the letter is 30 B Vreeland Road, Suite 200, Florham Park, New Jersey 07932, phone (844) 646-6639.
A plaintiffs’ firm has described a group called Storm claiming about 229 GB. The company letter does not state a volume or a group name. This post does not link a leak site.
What a reader can do with this
| Do | Why |
|---|---|
| Use the phone on the letter or on a statement | 1-866-200-0951 and (844) 646-6639 are the numbers MLD printed |
| Enroll by Jan 15, 2027 if the letter is yours | The Massachusetts copy specifies 24 months of IDX monitoring |
| Freeze credit at the three bureaus | The letter’s guide says a freeze is free and must be placed at each bureau |
| Type themoneystoreservicing.com | A mail that “verifies” the loan with a new link is not this notice |
The letter says affected systems were taken offline and that monitoring and access controls were tightened afterward. It does not describe the remote-platform settings.
MFA on servicing and on IDX
| Grade | Meaning |
|---|---|
| Fail | SMS or email codes are still a documented sign-in, or the login does not name YubiKey or Google Authenticator |
| Strong | FIDO2 / YubiKey-class security key for sign-in |
| Platform | Grade | YubiKey | Authenticator |
|---|---|---|---|
| The Money Store servicing | Fail | No | No |
| IDX enrollment login | Fail | No | No |
The Money Store’s MFA help, updated February 18, 2026, sends a one-time code by text message or email. It does not name YubiKey or Google Authenticator. Fail.
The IDX login asks for a code “displayed in the secure authentication app” on a phone. That page does not name YubiKey or Google Authenticator. Fail. Neither grade unsays a file that was already copied, and neither grade is the vendor remote platform in the letter.
Directory: MFA support directory · Business Apps.
Recommended MFA tools
| Product | Best for | Get it |
|---|---|---|
| YubiKey 5C NFC | USB-C laptops + NFC phones | Amazon |
| YubiKey 5 NFC | USB-A desktops + NFC phones | Amazon |
| Proton Pass | Passkeys + authenticator-style TOTP | Proton Pass |
We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.
Independent cybersecurity audits
We audited the company, the servicing host, IDX, and the three notice sites on October 24, 2026. 100% is the ideal — none reach it. These scores are public email / transport / website posture. They do not measure whether a mortgage file was in the affected set.
| Organization | Domain | Overall | vs 100% |
|---|---|---|---|
| IDX | idx.us | 85% | −15 |
| California AG | oag.ca.gov | 57% | −43 |
| The Money Store | themoneystore.com | 53% | −47 |
| Money Store servicing | themoneystoreservicing.com | 52% | −48 |
| Massachusetts | mass.gov | 43% | −57 |
| Texas Attorney General | texasattorneygeneral.gov | 37% | −63 |
| Domain | Identity | Transport | Website |
|---|---|---|---|
| idx.us | 90% | 45% | 90% |
| oag.ca.gov | 60% | 15% | 40% |
| themoneystore.com | 50% | 15% | 40% |
| themoneystoreservicing.com | 50% | 15% | 37% |
| mass.gov | 25% | 45% | 37% |
| texasattorneygeneral.gov | 10% | 15% | 40% |
Audit links: idx.us · oag.ca.gov · themoneystore.com · themoneystoreservicing.com · mass.gov · texasattorneygeneral.gov
themoneystoreservicing.com is 52%. Its certificate expires November 23, 2026. texasattorneygeneral.gov is Identity 10%. Type the hosts printed on the letter.
Website stack
Passive homepage + Certificate Transparency probes (October 24, 2026). Versions only — not a claim these homepages were the remote platform in the letter.
| Domain | Stack note |
|---|---|
| themoneystore.com | WordPress 7.1.3; GoDaddy TLS expires 2027-04-27 |
| themoneystoreservicing.com | CMS undetected; Let’s Encrypt TLS expires 2026-11-23 |
| idx.us | CMS undetected; Let’s Encrypt TLS expires 2027-01-08 |
| oag.ca.gov | Drupal 7; jQuery 1.9.1; DigiCert TLS expires 2027-04-24 |
| mass.gov | CMS undetected; DigiCert TLS expires 2027-04-04 |
| texasattorneygeneral.gov | CMS undetected; Sectigo TLS expires 2026-12-09 |
Blacklist and lookalikes
Email blacklist checks (public DoH, October 24, 2026): idx.us, mass.gov, and texasattorneygeneral.gov were clear. themoneystore.com and themoneystoreservicing.com showed SPFBL on a shared Mimecast MX. oag.ca.gov showed SPFBL on a Granicus GovDelivery MX. Those are provider-netblock hits, not led.
themoneystoreservicing.com had no threatening registered lookalike in this pass. themoneystore.biz and themoneystore.net point at the company. Short-name scans of idx.us, mass.gov, and oag.ca.gov are full of ordinary words and other agencies. cia.gov appeared in the California AG scan because the tool inserts a letter. That host is the Central Intelligence Agency.
| Lookalike | Technique | Signal |
|---|---|---|
| themoneystore.co | TLD swap | Mail (NS + A + MX) |
| themoneystore.info | TLD swap | Mail (NS + A + MX) |
| texasattorneygeneral.org | TLD swap | Mail (NS + A + MX) |
texasattorneygeneral.com redirects to the attorney general’s site. Continuous monitoring: Cybersquat Domain Monitoring.
CourtListener on October 24, 2026 shows several District of New Jersey cases naming MLD Mortgage. Cases filed October 9 are coded as tort, contract, or fraud, and they predate this letter. Jaiyeola v. MLD Mortgage, 2:26-cv-13706, was filed October 21, 2026, with no cause on the public index. We did not read a complaint in that case.
Related coverage
Sources: California sample letter · California AG report · Massachusetts notice 2026-1802 · AcidPeak filing summary · Servicing MFA help. Independent EmailMeNow audits, website-tech, blacklist, cybersquat, and CourtListener searches October 24, 2026. Domain scores: audit.emailmenow.com only.