Academy Mortgage Ordered to Provide Identity Theft Insurance After Data Breach

California financial regulators ordered Academy Mortgage Corporation to pay an $825,000 administrative penalty and provide 12 months of identity theft insurance to California borrowers affected by the company’s March 2023 data breach. The DFPI consent order says systems accessed during the ransomware attack stored PII belonging to 284,443 people, including 34,452 California residents.\n\nThis is a regulatory enforcement action, not a class-action settlement. There is no public settlement claim form or cash-payment deadline. Affected California borrowers must wait for official notice explaining how to opt in.\n\n## Order and eligibility\nAcademy must pay the penalty, retain an identity-theft insurance provider, notify affected California borrowers within the order’s timeline, and establish a consumer contact point. Coverage lasts 12 months from each participating borrower’s policy start.\n\n## What happened\nThe order says a threat actor breached the corporate network March 18, 2023, installed malware, stole credentials and initiated ransomware March 20. The breach was contained March 25; affected people were notified around December 20, 2023. DFPI found deficiencies in risk assessments, audits, patching, access controls, asset inventory, documentation and oversight. Academy entered the order without admitting or denying findings.\n\nBorrowers should wait for official opt-in instructions and avoid unofficial claims sites. This is general information, not legal advice.