LendingTree Data Breach

Officially acknowledged via filings with the California Attorney General and the Lamie et al v. LendingTree, LLC nationwide class action settlement, the compromised dataset for 200,631 unique consumers contains:

• Contact and Demographic Identifiers: First and last names, valid email addresses, and personal telephone numbers.
• Physical & Geographic Coordinates: Full residential street addresses, cities, states, ZIP codes, and originating IP addresses.
• Financial & Loan Application Specifics: Loan categories and types (Home Purchase, Home Equity, Home Refinance, Reverse Mortgage), property descriptions, estimated real estate valuations, and applicant credit profiles (Needs Imp, Fair, Good, Excellent).
• Military Service Status: Self-reported military service affiliations.

Note: No account credentials or passwords were compromised in this specific loan application dataset.

Canonical RFC extraction and deduplication across 401,295 application rows confirmed 200,631 unique consumer email addresses.

LendingTree disclosed that attackers exploited a code flaw in their web systems starting in mid-February 2022 before remediation was completed on June 3, 2022. The exposure of detailed credit tiers alongside residential addresses and contact numbers significantly elevates the risk of targeted mortgage fraud, loan imposter scams, and identity theft.

Individuals who submitted loan inquiries through LendingTree should:

• Remain vigilant against unsolicited communications claiming to represent mortgage lenders or financial underwriters requesting sensitive personal details or fees.
• Monitor credit reports and consider placing a fraud alert or credit freeze with major consumer credit bureaus.