On March 18, 2022, CMG Financial discovered that an unauthorized party may have gained access to certain customers’ personal and financial information, including their social security numbers. On March 30, 2022, CMG Financial began sending data breach notification letters to those affected by the incident.
If you have received a data breach notification, it is essential that you understand what is at risk and what you can do about it. To learn more about what you can do if your data has been stolen, see our previous blog post, “A Guide for Data Breach Victims”.
We have obtained a copy of the initial data breach letter issued by CMG Mortgage, Inc:
We are writing to inform you of an information security incident that may involve certain personal information that you have provided to CMG Mortgage Inc. (“CMG” or the “Company”). We are providing this notice as a precautionary measure to inform potentially affected persons of the incident and to draw your attention to certain steps you can take to protect yourself. Rest assured that we have taken reasonable steps to resolve the incident.
On March 18, 2022, the Company became aware of potential unauthorized access to personal information about a small subset of customers. The personal information involved in the incident is usually included in the loan application and may include your name, address, date of birth, social security number, driver’s license number, bank account number, and loan application number. Based on our investigation, it appears that you are among those whose information may be affected by this incident. Please note that at this time we are not aware of any fraud or misuse of your information as a result of this incident.
We take the privacy of personal information seriously and deeply regret that this incident has occurred. We took steps to address the incident quickly after it was discovered, including rebuilding and segmenting the affected system and launching an internal investigation. We regularly take steps to strengthen the security environment of our systems to protect customer data. For example, we are implementing additional layers of protection designed to prevent unauthorized access in the future and to improve the security of our systems, including implementing multi-factor authentication, further segmenting the network and internal systems CMG and upgrading CMG’s document management system.
What we do to protect your information
To help protect your identity, we offer a free 24-month membership to Experian’s® IdentityWorksSM. While identity restoration assistance is immediately available to you, we also encourage you to activate the fraud detection tools available through Experian IdentityWorks as a free two-year subscription. This product gives you superior identity detection and identity theft resolution. To activate your membership and start monitoring your personal information, please follow the steps below:
- Be sure to register by: [enrollment end date] (Your code will not work after this date.)
- Visit the Experian IdentityWorks website to register: [URL]
- Enter your activation code: [code]
If you have questions about the product, need help restoring your identity, or want an alternative to online registration for Experian IdentityWorks, please contact the Experian Customer Service team at [service number] by [enrollment end date]. Be prepared to provide the assignment number as proof of eligibility for identity restoration services by Experian.
ADDITIONAL DETAILS ABOUT YOUR EXPERIAN IDENTITYWORKS 24-MONTH MEMBERSHIP: A credit card is not required for Experian IdentityWorks enrollment.
You can contact Experian immediately with fraud concerns and have access to the following features once you register with Experian IdentityWorks:
- Experian credit report during registration: view the information associated with your credit report. Daily credit reports are only available to online members.1
- Credit Monitoring: Actively monitors Experian, Equifax and TransUnion files for indicators of fraud.
- Identity Restoration: Identity restoration specialists are immediately available to help you fight credit and non-credit related fraud.
- Experian IdentityWorks ExtendCARE: You get the same high level of identity restoration support even after your Experian IdentityWorks membership expires.
- Up to $1 Million in Identity Theft Insurance: Provides coverage for certain costs and unauthorized electronic funds transfers.
If you believe there has been fraudulent use of your information and would like to discuss how you might resolve these issues, please contact an Experian agent at [customer service number]. If, after discussing your situation with an agent, it is determined that identity restoration assistance is required, an Experian Identity Restoration agent is available to work with you to investigate and resolve each security incident. fraud occurred (including, where applicable, helping you contact credit grantors to dispute charges and close accounts; helping you freeze your credit file with the three major credit bureaus; and helping you contact agencies to help you restore your identity to its normal state).
Please note that this identity restoration assistance is available to you for 24 months from the date of this letter and does not require any action on your part at this time. The terms and conditions of this offer can be found at www.ExperianIDWorks.com/restoration. You can also find self-help tips and information about protecting your identity on this site.
We sincerely apologize for this incident and regret any inconvenience it may cause you. If you have any questions or concerns about this, please do not hesitate to contact us at [Phone Number] between 9:00 a.m. and 5:00 p.m. Eastern Time, Monday through Friday or via email at [name]@cmgfi.com. Again, we sincerely regret any concern this incident may cause.