Benworth Capital Data Breach
The 2025 Benworth Capital Partners data breach occurred when an actor accessed parts of the company's systems through a third-party service provider and removed files. The Texas Attorney General's record reports that 275,000 people were affected.
Exposed Data Types
16- Names
- Physical addresses
- Phone numbers
- Dates of birth
- Social security numbers
- Taxpayer identification numbers
- Driver's license numbers
- Passport numbers
- Loan information
- Citizenship status
- Employment information
- Credit report information
- Income information
- Asset information
- Tax records
- Bank account numbers
About This Breach
Benworth is a Florida-based real estate lender. The affected files contained personal and financial information belonging to loan applicants, borrowers, and some spouses.
How did the Benworth data breach happen?
The company's notice says the incident began around May 18, 2025 when an actor accessed Benworth systems through a service provider. Benworth discovered on May 23 that files had been taken.
The company was able to begin identifying the particular files involved on June 23. The service provider and technical initial-access method were not publicly disclosed.
What information may have been affected?
The categories varied by notification wave and person. Disclosed fields may have included names, addresses, phone numbers, dates of birth, Social Security or taxpayer-identification numbers, and driver's-license or passport details.
Loan applications and account details, loan amounts and dates, citizenship and employment histories, credit reports, income, assets, tax returns, and bank-account information were also involved for some people. Not every data category was present for every affected individual.
How many people were affected?
The Texas Attorney General's current record reports 275,000 affected individuals, including 22,895 Texas residents. This is an affected-person total, not a count of loan files or documents.
What risks can this information create?
Social Security numbers, dates of birth, and government-identification details can be used in identity theft, fraudulent loan applications, or tax fraud attempts.
Loan amounts, maturity details, and banking information can help attackers create targeted messages that appear to concern a genuine borrowing relationship. Accurate loan details do not prove the sender is authorized by Benworth.
How did Benworth respond?
Benworth said it negotiated for the return and deletion of the stolen files, restored confidence in system security, and strengthened security processes involving its service providers.
The company offered complimentary identity protection and credit monitoring. A supplemental Washington filing said dark-web monitoring had found no indication that the affected files had been released.
What should affected people do?
Notice recipients can monitor credit reports, bank accounts, loan applications, and tax records for unfamiliar activity. If a Social Security number was involved, a credit freeze or fraud alert may be appropriate.
For an unexpected message claiming to come from Benworth, a loan officer, or an identity-protection service, use the organization's official contact channel before following a link. Do not share a password, payment detail, or verification code.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
