iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
BlackCat/ALPHV claimed responsibility for attacks on loanDepot and Prudential Financial, SecurityWeek reported on February 19, 2024. That claim is not the same as a company-confirmed attribution: the filings discussed here describe each company’s incident findings but do not identify BlackCat/ALPHV as the attacker. The disclosures also differ sharply: loanDepot reported data encryption and a large exposure of personal information, while Prudential later said it found no evidence of ransomware or malware.
What did BlackCat/ALPHV claim?
SecurityWeek reported on February 19, 2024, that the ransomware group BlackCat/ALPHV had taken credit for attacks on loanDepot and Prudential Financial. This establishes what the group reportedly claimed, not independent proof that it carried out either intrusion. The companies’ filings reviewed for these incidents did not attribute the activity to BlackCat/ALPHV.
What loanDepot disclosed
January 8: unauthorized access and encryption
In a January 8, 2024 SEC filing, loanDepot said unauthorized activity included access to company systems and encryption of data. The company said it shut down certain systems while securing its operations and restoring service.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →January 22: personal information affected
In a January 22 update, loanDepot said its investigation had found unauthorized access to sensitive personal information belonging to approximately 16.6 million individuals. It said it would notify affected individuals and provide credit monitoring and identity protection at no cost. The company also described efforts to restore loan origination and servicing systems, including the MyloanDepot and servicing customer portals. CEO Frank Martell said, “We sincerely regret any impact to our customers.”
#1 Best Overall
February: revised expected notifications and costs
A later SEC amendment said loanDepot expected to notify up to approximately 16.9 million people whose sensitive personal information had been affected. The same amendment estimated first-quarter 2024 incident expenses of approximately $12 million to $17 million, net of expected insurance recovery. These are dated company disclosures and estimates, not final audited totals or independently calculated figures. The later expected notification count is not identical to the earlier January 22 figure, so the dates and qualifiers matter.
What Prudential Financial disclosed
February 5: initial detection
Prudential said it detected unauthorized access on February 5, 2024, and that the access had begun on February 4. Its initial filing said the company had no evidence at that time that the threat actor had taken customer or client data.
February 21: investigation update
In a February 21 amendment, Prudential said its investigation had identified exfiltration from a platform of limited data, including some client information and personally identifiable information. It also reported that company administrative and user data had been accessed and exfiltrated, and that a small percentage of employee and contractor user accounts had been accessed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
That later filing said Prudential had found no evidence of malware, ransomware, destruction or alteration of data, or continuing attacker access as of the filing. It updates the initial disclosure: the first filing’s statement about no evidence of customer or client data theft described what was known at that earlier point, not the later investigation finding.
Rank #3
How the two incidents compare
| Disclosure point | loanDepot | Prudential Financial |
|---|---|---|
| Timing reported by company | Unauthorized activity disclosed January 8, 2024; later investigation updates followed on January 22 and in a February SEC amendment. | Unauthorized access began February 4, 2024, and was detected February 5; an amendment dated February 21 provided additional findings. |
| Access and data | Reported access to company systems and unauthorized access to sensitive personal information of approximately 16.6 million individuals in its January 22 update; later expected notifications were up to approximately 16.9 million. | Later reported limited client and personally identifiable information exfiltration, as well as exfiltrated administrative and user data; a small percentage of employee and contractor accounts were accessed. |
| Encryption, ransomware, or malware | Reported data encryption in its January 8 filing. | As of its February 21 amendment, reported no evidence of ransomware or malware, or of data destruction or alteration. |
| Response described | Shut down certain systems while securing operations and restoring service; said affected individuals would receive notice and no-cost credit monitoring and identity protection. | Reported its detection and investigation findings in sequential filings; no comparable individual notification or protection offer is established in the disclosures summarized here. |
What affected people should take from the disclosures
For loanDepot, the company said it would notify affected individuals and offer credit monitoring and identity protection at no cost. That was a historical offer to affected people; the disclosures summarized here do not establish that it remains available to every reader today.
For Prudential, the later filing establishes that some client and personally identifiable information was exfiltrated, but it does not specify a comparable total number of affected people. The initial statement that there was no evidence of customer or client data theft should be read alongside—not instead of—the February 21 update.
These filings document company statements made in 2024. They do not, by themselves, establish later investigative conclusions, litigation outcomes, or current remedies.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsQuick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
