Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Mr. Cooper reported a cyber incident in October 2023, and a federal court opinion later recounted allegations that personal information belonging to more than 14 million customers was exposed. The court’s figure comes from the complaint; the exact 14.7 million headline figure is not independently confirmed by the official sources cited here. The reported data categories include Social Security numbers and bank-account numbers, but exposure does not establish that the information was published or misused.
What happened in the Mr. Cooper breach?
Mr. Cooper said it detected unauthorized access to certain technology systems on October 31, 2023. It initiated its incident response, shut down systems as a precaution, notified law enforcement and regulators, and engaged cybersecurity experts. Its SEC filing says customer systems were inaccessible from November 1 through November 4; some customers could not make payments or access accounts during that period. Servicing operations restarted on November 4.
The company said customers would not face late fees, penalties, or negative credit reporting for late payments caused by the incident.
What information was exposed?
A December 2, 2025 opinion from the U.S. District Court for the Northern District of Texas recounts plaintiffs’ allegations that personal information for more than 14 million customers was exposed. The categories listed in the opinion include:
#1 Best Overall
- Names and addresses
- Phone numbers
- Social Security numbers
- Dates of birth
- Bank-account numbers
These are allegations recited in the court record, not a finding that every listed type of information was exposed for every affected customer. The exact 14.7 million figure has not been independently established in the official sources cited here. The opinion also recounts plaintiffs’ allegation that hackers may have retained a separate copy of data. That allegation is not a judicial finding that data was retained, published, or misused. Read the court opinion for the procedural context.
Was the information published or used for fraud?
Mr. Cooper’s breach notice said the company was monitoring the dark web and had not seen evidence that data related to the incident had been further shared, published, or otherwise misused. That is the company’s report of what it had observed; it is not an independent guarantee that no misuse occurred. The court opinion separately recounts plaintiffs’ allegation that a copy may have been retained. Neither statement establishes that the information appeared publicly or was used to commit fraud.
The sources cited here do not establish a total for downstream identity theft or financial losses. If you received a notice, use it to determine whether the company says your information was affected and follow any instructions that remain current.
What should you do if you received a breach letter?
Review accounts and credit reports
Mr. Cooper’s notice recommended reviewing account statements and credit reports for unfamiliar activity. If you spot a suspicious transaction, contact the relevant financial institution using its current official contact details.
Consider a fraud alert or security freeze
A fraud alert asks creditors to take additional steps to verify your identity before opening new credit. A security freeze restricts access to your credit file for most new-credit applications until you lift or remove it. These are separate actions from credit monitoring; consider which, if either, suits your circumstances and check current instructions with the relevant credit bureaus.
Check whether the monitoring offer is still available
The breach notice offered 24 months of single-bureau credit monitoring from enrollment, along with fraud assistance through Cyberscout/Identity Force. Enrollment was required within 90 days of the letter. The accessible notice copy does not provide a reliable issue date, so that historical offer should not be treated as available now or used to calculate a current deadline. Check the notice and use current information from Mr. Cooper if you need to ask about assistance.
If you suspect identity theft or see suspicious activity, the notice directed customers to the incident response line printed in the mailed letter. Because contact details and service availability can change, use current contact information from Mr. Cooper or the relevant credit bureau rather than relying on an old number.
What is the status of the lawsuit?
In Cabezas v. Mr. Cooper Group, Inc., a July 2025 order dismissed claims for breach of express contract, unjust enrichment, invasion of privacy, and breach of confidence; negligence and implied-contract claims were allowed to proceed past the motion-to-dismiss stage, and the court deferred other claims. Mr. Cooper’s SEC disclosure also described discussions with state regulators and attorneys general about ongoing investigations. These procedural developments do not amount to a final judgment on liability, and the cited disclosure does not establish a final resolution.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Do not confuse this incident with the Cooper Clinic breach
The Mr. Cooper incident involved a mortgage servicer and began in October 2023. A separate matter, Maroulis v. Cooper Clinic, concerns Cooper Clinic, Cooper Medical Imaging, and Cooper Aerobics and describes a February 2023 incident with notices to 117,925 individuals. That is not the Mr. Cooper breach; its settlement terms and affected-person count do not apply here. See the Cooper Clinic settlement information.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
