Lennar Mortgage data breach 2026: What was exposed and what you should do

Lennar Mortgage, LLC has confirmed that an unauthorized party used social-engineering tactics — tricking people, rather than breaking software — to access some of its systems from May 26 to June 1, 2026. The company says it learned of the issue on June 1 and finished reviewing what information may have been involved on August 4. It filed a sample notice with the California Attorney General on August 14, 2026.

Information that may have been involved includes names, contact information, dates of birth, Social Security numbers, passport or other government-ID details, driver’s licenses or other state IDs, and financial-account information. A very small number of people may also have had medical-related information involved. Not every category applied to every person. The company says it is not aware of any actual misuse. Neither its letters nor the California filing state how many people were affected nationwide.

A mortgage file is not a store rewards list

The official wording is careful, and it is also accurate as far as it goes: a limited portion of systems, less than a week of access, not every data type for every person, no known misuse, two years of free monitoring. That is what Lennar Mortgage put in the letters it sent and in the sample it filed with California.

What that wording does not change is the kind of file a mortgage lender keeps. Those records already tie together a legal name, a date of birth, a Social Security number, government ID details, financial accounts, and a way to reach you — the same package a lender needs to know you are you and that you can pay for a house. A thief does not need every field on every person. Name, date of birth, and a Social Security number are enough to open credit or file a tax return. Add a driver’s license or a bank account and impersonating you to a financial company gets easier still.

There is a second, quieter problem. The attackers got in by talking their way in. The files they may have seen include contact information. That combination is built for the next phone call or email: someone who already knows you have a Lennar loan, mentions this incident or the Kroll offer, and asks you to “verify” an account. The network access ended June 1. The social-engineering does not have to.

Monitoring is useful as an alarm. It is not a lock. A Social Security number cannot be swapped out the way a password can, and the company cannot pull the data back.

What to actually expect

• If Lennar Mortgage decided your information may have been involved, you should receive a letter offering two years of free Kroll identity monitoring. The activation deadline in that offer is November 20, 2026.
• There is no public list of whose records were accessed, and no outside service can reliably tell you whether you were included. A letter is the company’s own notice. Silence is not a guarantee either way.
• Expect follow-up scams that mention your mortgage, this incident, or the monitoring enrollment and try to get you to click, call, or hand over more information.
• The company says it has not seen the information actually misused. If fraud does appear, new credit accounts and tax-return problems are the usual forms, and they often show up months later, not the week of the letter.

What you can and cannot fix

If your Social Security number, driver’s license or other government ID number, date of birth, or financial-account information was in the systems that were accessed, that information is out. It cannot be recalled, deleted from the thief’s hands, or made unused by changing your email or phone number. A national ID number that has been copied stays usable.

What actually helps, in order:

• If you received the letter, enroll in the Kroll monitoring before November 20, 2026. That deadline is set by the offer. Do it through the instructions in the letter, not through a link in an unexpected email or text.
• Place a credit freeze with Equifax, Experian, and TransUnion. A freeze is what blocks most new accounts opened with a leaked Social Security number. Monitoring only tells you after something appears.
• Assume unexpected calls, texts, or emails about your Lennar loan, this breach, or “confirming your identity” are attempts to trick you, unless you started the contact using a number or address you already had.
• Remove what you can from people-search and data-broker listings. A leaked mortgage record becomes much more dangerous when it is joined to relatives, phone numbers, employers, and previous addresses those sites already publish. The Lennar data cannot be taken back. Those public listings can be taken down, which is why they are the lever that is still in your hands.