New American Funding Listed by everest Ransomware Group

On July 15, 2025, mortgage lender New American Funding appeared on the leak site of the Everest ransomware group after the company’s internal files were allegedly exfiltrated during a ransomware attack.

What Public Reporting Shows

Available reporting describes the incident as a ransomware deployment that resulted in the theft of internal documents. The Everest ransomware group listed New American Funding on its data-leak portal, a common tactic used to pressure victims into payment. Public reporting indicates the exposed material consists of internal files; the exact volume and full list of records remain unconfirmed by the company. No specific count of affected customers has been released, yet any mortgage-related records would likely contain names, addresses, Social Security numbers, income details, bank account information, and loan application data. The listing appeared on the group’s onion site, accessible via the address hosted on ransomware.live.

Why This Matters for You and Your Family

If you or anyone in your household has applied for a mortgage, refinanced a home, or used New American Funding’s services in the past two decades, your personal financial information may now sit in attackers’ hands. Mortgage records are especially damaging because they tie your identity, income, residence, and banking details together in one package. Criminals can use this information to file fraudulent tax returns, open new accounts in your name, or impersonate you when contacting banks and government agencies. For families, the breach raises the risk that children’s records included in joint applications could also be exposed, creating long-term identity problems that surface years later.

The Doxxing and Identity-Chain Implications

Stolen mortgage files rarely stay isolated. Attackers routinely cross-reference names, emails, phone numbers, and addresses against other leaked datasets. This process builds an identity chain that links your professional life, social-media handles, children’s school records, and even gaming accounts. Once the chain exists, a single credential leak can lead to account takeovers across multiple services. Gaming accounts belonging to you or your children are frequent targets because they often reuse passwords and contain payment methods or chat logs that reveal additional personal details. The result is accelerated doxxing, harassment, or further extortion attempts that reach beyond financial fraud into daily life.

Everest Ransomware Group’s Track Record

Public reporting attributes the Everest ransomware operation to a group that emerged in 2021. The collective has targeted organizations across healthcare, education, manufacturing, and financial services. Notable prior victims include hospitals, school districts, and mid-sized lenders whose data appeared on the same leak site. Their typical playbook begins with initial access through phishing or exploited remote desktop credentials, followed by lateral movement inside the network, data exfiltration, and deployment of ransomware. After encryption, the group publishes samples of stolen files and sets payment deadlines, threatening full data release if demands are not met. Everest usually allows a short negotiation window before escalating public pressure.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, addresses, and online handles that may have been exposed in the New American Funding files.
• Rotate any password you used at New American Funding or any mortgage-related site, then enable 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught and addressed in hours, not months.
• Cover the household with DoxxScan family protection that includes dependents and children’s gaming accounts, which often chain back to the same addresses and credentials.
• Let remediation specialists handle takedown requests for any exposed personal records appearing on data-broker or underground sites.

The incident underscores that mortgage data breaches continue to surface long after the initial compromise, making early detection and thorough identity-chain mapping essential. Start your DoxxScan trial today and pair it with hands-on remediation by specialists who manage the full scope of exposure for you and your family, including gaming accounts vulnerable to credential-stuffing attacks that follow leaks like this one. Continuous monitoring across billions of records remains one of the few practical defenses available to ordinary families.