HOUSELOAN.COM Listed by Clop Ransomware Group

On March 10, 2023, mortgage lender Cornerstone Home Lending (operating as houseloan.com) appeared on the leak site maintained by the Clop ransomware group. The listing states that internal files were exfiltrated during a ransomware attack; the exact number of affected individuals and the full scope of records remain undisclosed by the company or the threat actors.

Details from the Clop Listing

The primary disclosure on the Clop leak site indicates that internal files were taken from houseloan.com. No specific volume of customer records, loan documents, or employee data is quantified. The group gave the lender a deadline to negotiate before public release of the stolen material would begin. As of the listing date, the site showed samples but did not publish the complete archive. Public reporting on Clop’s past behavior shows the actors routinely post proof-of-compromise screenshots and then wait for payment or begin gradual data dumps.

Why This Matters for You and Your Family

If you obtained a mortgage, refinanced, or applied for a home loan through Cornerstone Home Lending, your personal and financial information may sit inside the exfiltrated files. Mortgage applications routinely contain full names, Social Security numbers, dates of birth, addresses, bank account details, tax returns, and employment history. Exposure of even a subset of these records increases the chance that identity thieves can open new accounts, file fraudulent tax returns, or impersonate you with lenders. Because the breach notification does not specify which records were taken, every customer from that period must treat their data as at risk.

Doxxing and Identity-Chain Risks

Stolen mortgage files create long-term doxxing chains. A single leaked email or phone number can be cross-referenced with gaming accounts, social-media handles, and family-member profiles. Threat actors and data brokers routinely link these fragments to build complete household dossiers. Children’s names and dates of birth appearing on parent loan applications are especially valuable because minors lack credit histories and their identities can remain undetected for years. Credential leaks of this type frequently cascade into account takeovers on unrelated services where the same email and password were reused.

Clop’s Known Track Record

Public reporting attributes the emergence of Clop (also stylized as Cl0p) to roughly 2019. The group rose to prominence through aggressive use of the GoAnywhere file-transfer vulnerability and earlier MOVEit exploits, targeting organizations that handle large volumes of sensitive personal and financial data. Notable prior victims include financial service firms, healthcare providers, and universities. Clop’s typical playbook involves initial access via exploited file-transfer software or phishing, followed by claimed exfiltration of internal shares before encryption. The group then demands multimillion-dollar payments and, if unpaid, posts samples on their Tor leak site while threatening to sell or further release the data. Their extortion style combines public shaming with selective leaks designed to pressure victims into silent settlements.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Rotate any password you used at houseloan.com or Cornerstone Home Lending anywhere else it is reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that can chain back to the same leaked address or SSN.
• Let remediation specialists perform hands-on takedown requests across data brokers and extortion sites on your behalf.

The incident underscores that even a single lender breach can expose an entire family’s financial footprint for years. Starting proactive defense now limits how far attackers can travel along the identity chain created by this and future leaks. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that explicitly includes children’s gaming accounts vulnerable to credential-based takeovers.