The Money Store data breach lawsuits after alleged ransomware attack

At least four proposed class action lawsuits were filed October 9, 2026 against MLD Mortgage Inc., the New Jersey mortgage lender that does business as The Money Store. Court records on CourtListener list all four in the U.S. District Court for the District of New Jersey. Reporting on two of the complaints says they follow an alleged ransomware attack that exposed borrower information, including Social Security numbers and loan application files.

These are allegations in newly filed cases. No court has made any findings, no class has been certified, and no settlement or payment exists. The Money Store had not published a public explanation of the incident in the sources reviewed for this article, and no state regulator breach notice was found. People who applied for or obtained a mortgage through The Money Store can follow the case and ask a lawyer whether they may belong to the proposed class.

MLD Mortgage Inc. is the defendant in each case. It operates as The Money Store, NMLS ID 1019, from Florham Park, New Jersey. Its website describes it as a family-owned, privately held lender serving homebuyers and homeowners nationwide, and its state licensing page says it is licensed in 49 states and Washington, D.C. Borrowers usually share income, employment, asset and property records with a lender during the mortgage process, which explains why a lender's systems can hold sensitive files.

CourtListener lists these cases, all filed October 9:

• Chavez v. MLD Mortgage Inc., No. 2:26-cv-13209
• Turner v. MLD Mortgage Inc., No. 2:26-cv-13218
• Munoz v. MLD Mortgage Inc., No. 2:26-cv-13231
• Turner v. MLD Mortgage, Inc. d/b/a The Money Store, No. 2:26-cv-13238

Mortgage Professional America reported that Robert Turner, a Washington state resident described as a former client, filed through Milberg, PLLC. It reported that Angel Chavez of San Pedro, California, filed through Kopelowitz Ostrow P.A. Law360's case page also lists Kopelowitz Ostrow on the Chavez case. This article did not verify counsel for the Munoz case or the reason two dockets carry the Turner name.

According to both complaints described by Mortgage Professional America, a ransomware group called Storm added The Money Store to its public list of breach victims on or about September 22, 2026. The complaints describe Storm as responsible for numerous breaches since August 2026 and as using double extortion. That term means encrypting a company's data while also threatening to publish stolen files unless a ransom is paid.

The complaints allege the compromised information includes full names, contact information, Social Security numbers, financial account information, loan application details, income and employment records, property and mortgage documentation, and credit history information. They also say the lender admitted that unauthorized individuals accessed information in its system but gave little detail on how it happened.

The number of affected people, the date the intrusion began, and the date The Money Store discovered it are not established by the sources reviewed. The September 22 date is the alleged posting date on the group's list, not a confirmed breach date.

The plaintiffs allege The Money Store collected highly sensitive data from borrowers, owed them a duty to protect it, and failed to use reasonable cybersecurity. Both complaints described in the reporting cite the NIST Cybersecurity Framework, a federal set of practices for managing cyber risk, as a standard the lender allegedly did not meet. They also allege the lender did not promptly notify affected borrowers.

Each complaint brings four claims: negligence, negligence per se, unjust enrichment and breach of implied contract. Turner says he has received a significant increase in spam since the breach and paid for credit monitoring himself. Both plaintiffs say they have spent time reviewing statements and credit reports. Each case alleges more than $5 million in controversy and demands a jury trial.

No response from The Money Store to these lawsuits was found in the sources reviewed. That absence does not mean the company admits or denies the allegations.

The court has not decided anything about the merits. The cases were filed days ago. A defendant usually responds by answering or by asking the court to dismiss, and no such filing was verified.

Class certification is the step where a judge decides whether claims can proceed on behalf of a defined group. That has not happened. When several similar suits are filed in one court, judges often consider combining them, and plaintiffs' firms may ask to be appointed to lead the case. Whether that happens here is not yet known.

The complaints seek to represent a nationwide class of people whose personal information was compromised in the alleged breach, according to the reporting. The exact class wording was not available for review because the complaints were not posted on CourtListener's public archive.

In practice, the people most likely to be covered are borrowers and loan applicants whose files The Money Store held. A notice letter from the company, if one is sent, would be the strongest evidence that your information was involved. Without one, a past loan or application is a reason to ask, not proof of exposure.

Check names carefully. These cases name MLD Mortgage Inc., the Florham Park lender with NMLS ID 1019. A loan with a different lender or servicer is not covered just because the name sounds similar.

If you get a breach notice from The Money Store, keep it and follow any instructions for credit monitoring or identity protection that come directly from the company or its named provider. Be careful with unsolicited emails or calls that reference the breach and ask for account details.

You can talk to a lawyer about the pending cases. The plaintiffs' firms named in the reporting are Milberg and Kopelowitz Ostrow. Speaking with a firm, or submitting an inquiry through Class Action Pulse, does not file a claim, join a lawsuit or create representation. Any representation requires a separate agreement.

The Federal Trade Commission says credit freezes are free and must be placed with each of the three major credit bureaus. A fraud alert is also free, and placing one with any bureau notifies the other two. Those steps are general protections, not benefits from this case.

Nothing is available now. There is no settlement fund, payment formula or claim form. The lawsuits ask for damages and other relief, but those requests are not awards. Amounts from other data breach settlements cannot predict a result here.

If the cases later settle, class members would typically learn about benefits and deadlines through a court-approved notice. Until then, any specific dollar figure attached to this case should be treated with suspicion.

• September 22, 2026: alleged date the Storm group listed The Money Store, according to the complaints.
• October 9, 2026: the four federal lawsuits were filed.

No claim, opt-out, objection or hearing deadline exists. The lack of a settlement deadline does not mean unlimited time to bring an individual claim. Legal deadlines vary by state and claim type, so ask a lawyer about your own situation.

Ransomware is malicious software that locks or encrypts a victim's files and is often paired with a demand for payment. Negligence per se is a negligence claim based on the alleged violation of a law or regulation meant to protect people like the plaintiff. Unjust enrichment claims argue a party kept a benefit it should not keep. An implied contract is an agreement inferred from conduct, here the alleged expectation that a lender would protect borrower data it required.

A putative class member is someone who would be included in a proposed class if a court certifies it. Being a putative member gives no right to payment by itself.

The next steps are likely to be service on the company, a response deadline, and possible requests to combine the cases. The Money Store may also send notice letters or file regulatory breach reports that clarify what data was involved and how many people were affected.

A practical note: keep any loan paperwork and correspondence from The Money Store in one place. If a notice arrives later, you will be able to match it against your records quickly.

CourtListener supports the four case captions, numbers, court and filing date. Mortgage Professional America supports the descriptions of the Turner and Chavez complaints, including the alleged data types, claims and counsel. Law360 confirms the Chavez case and its firm. The company's website and licensing page support its identity. This article did not read the complaints directly because they were not available, and it found no company statement or regulator notice. Those gaps limit what can be confirmed about the incident.

Class Action Pulse is not a law firm and does not guarantee eligibility, representation or payment. This article is general information, not legal advice.