America's Biggest Banks Rush to Assess Damage from SitusAMC Vendor Hacking

Some of America’s largest financial institutions are reportedly working urgently to assess potential damage from a significant cyberattack on SitusAMC, a critical vendor used by hundreds of banks, including JPMorgan Chase, Citibank, and Morgan Stanley, to process real estate loans and mortgages.

The New York-based company, which employs approximately 5,000 people and is owned by several private equity firms, confirmed on Saturday (November 22) that it was breached on November 12 and has spent nearly two weeks investigating the scope of compromised data related to residential loan mortgages.

Citing five people briefed on the incident, The New York Times reported that JPMorgan Chase, Citibank, and Morgan Stanley are among the institutions notified by SitusAMC that client data may have been stolen. A JPMorgan spokesperson clarified that the bank itself had not been directly hacked.

The breach has generated particular alarm on Wall Street due to the nature of information SitusAMC handles. The vendor maintains vast collections of personal data from loan applications, including Social Security numbers and other sensitive financial information. SitusAMC CEO Michael Franco said in a statement that the company has notified law enforcement and “remain[s] focused on analyzing any potentially affected data.” The company has been providing near-daily updates to banking clients as the investigation continues.

Meanwhile, FBI Director Kash Patel addressed the incident, stating: “While we are working closely with affected organizations and our partners to understand the extent of potential impact, we have identified no operational impact to banking services.” SitusAMC serves as essential infrastructure for the real estate lending industry, offering services including loan origination, collection, and regulatory compliance.