New American Funding - Full leak published Listed by Everest Ransomware Group

On July 24, 2025, the Everest ransomware group published what it described as the full leak of internal files allegedly stolen from New American Funding, a family-owned mortgage lender that has provided home loans across the United States since 2003.

What Public Reporting Shows

Public reporting indicates the company was hit by a ransomware attack in which attackers exfiltrated internal documents before publishing them on the Everest leak site. The exposed material consists of internal files taken during the intrusion. The exact number of people whose records appear in the leak remains unknown, and the specific categories of personal data have not been independently verified by third parties. New American Funding specializes in conventional, FHA, VA, jumbo, and first-time buyer loans, and has focused on underserved communities. The leak site posting on July 24, 2025, carried the label “Full leak published,” which typically signals that negotiations failed and the stolen data was released.

Why This Matters for You and Your Family

If you or anyone in your household has applied for a mortgage, refinanced, or used any real-estate financing services from New American Funding in the past two decades, your personal information may now sit in files available to criminals. Mortgage applications routinely contain full names, Social Security numbers, dates of birth, addresses, phone numbers, email accounts, employment history, bank account details, and income documentation. Once that combination leaves a company’s control, it can be used to file fraudulent tax returns, open accounts in your name, or pressure you with threats of exposure. Your family’s financial stability depends on how quickly you discover and address every place this information has traveled.

The Doxxing and Identity-Chain Risks

A single breach like this rarely stops at one company. Criminals chain together leaked credentials, email addresses, phone numbers, and usernames to build a complete profile. Public reporting shows that mortgage-customer data frequently surfaces on dark-web marketplaces and is cross-referenced with gaming accounts, social-media handles, and family-member records. When children use the same email address or a reused password for online games, the chain extends to their profiles as well. The result can be doxxing campaigns, account takeovers, or targeted extortion that affects every member of the household.

Everest Ransomware Group Track Record

Public reporting attributes the attack to the Everest ransomware group, which emerged in 2021. The gang has listed hundreds of organizations on its leak site, with notable prior victims including healthcare providers, manufacturers, and financial-services firms. Their typical playbook begins with initial access through phishing or exploited remote-desktop services, followed by claimed exfiltration of sensitive files and deployment of ransomware. When victims do not pay, Everest publishes samples and eventually the full dataset on its onion site, using the exposure as leverage. The group’s postings often carry countdown timers before “full leak published” appears.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what this leak connects to.
• Rotate the password you used at New American Funding anywhere else it is reused, and switch on 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next exposure is caught in hours instead of months.
• Cover the household with DoxxScan family protection that includes dependents and children’s gaming accounts, which often chain back to the same addresses and credentials.
• Let remediation specialists handle takedown requests across data brokers while you focus on securing accounts and watching for identity-theft alerts.

The breach of New American Funding illustrates how quickly mortgage records can feed larger identity chains that threaten every family member. Taking deliberate steps now limits the damage and reduces the chance that this leak becomes the starting point for future attacks. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that explicitly protects children’s gaming accounts from cascading takeovers.