The Tennessee-based residential mortgage company Churchill Mortgage Corporation recently filed an official notice of a data breach. According to the company’s official filing, the breach resulted from an unauthorized party gaining access to an employee’s email account. Churchill Mortgage reports that the names, Social Security numbers and financial account numbers of certain individuals were accessible to the unauthorized party. On April 12, 2022, Churchill Mortgage provided data breach notification letters to those whose information was affected by the breach.
If Churchill Mortgage Corp. sends you a data breach letter, your sensitive information was among that which was included in the compromised email account. As a result, a malicious cybercriminal may have your personal information in their possession. To learn more about how to protect yourself from becoming a victim of fraud or identity theft and what your legal options are in the wake of the Churchill Mortgage data breach, see our recent blog post here.
What Led to the Churchill Data Breach?
The recent data breach at Churchill occurred because an unauthorized party was able to gain access to one of the company’s employee’s email accounts. The company doesn’t state when it first noticed the unauthorized activity. However, in its official filings, Churchill Mortgage explains that it wrapped up its investigation into the incident on February 10, 2022, confirming that the unauthorized user had access to certain individuals’ names, financial account information and Social Security numbers.
How Do Hackers Gain Access to Employee Email Accounts?
To be clear, Churchill Mortgage does not elaborate on the details leading up to the breach. However, email-based cyberattacks can occur in a number of ways. Often, when an unauthorized user orchestrates a data breach by obtaining employee email credentials, the attack involves an email phishing attack.
Phishing attacks rely on social engineering to get someone to provide information or download malicious software. These social engineering attacks involve sending a fraudulent message disguised as a legitimate one in hopes of tricking the recipient into revealing sensitive information or installing malware on their device.
The information obtained through a successful email phishing campaign is often used to commit fraud or identity theft against the information’s owner. So, while a company is often considered a “victim” of a phishing attack, the real victims are those whose information is stolen in these cyberattacks.
How Common Are Phishing Attacks?
Phishing email attacks are very common and one of the leading causes of data breaches. According to a 2021 study, employees in the United States receive an average of 14 malicious emails per year. Some workers, such as those in the retail industry, receive 49 malicious emails per year. These attacks are well-designed and appear to come from trusted sources. So much so that 86% of companies had at least one employee who clicked a phishing link in 2021.
Given the frequency of phishing attacks, businesses are aware of the threat phishing attacks pose and should take the appropriate steps to educate their employees and strengthen their data security measures. In fact, many companies have recently begun to require employees to take special courses designed to help them identify phishing attacks. However, there are also back-end data security measures that organizations can use to reduce the number of phishing emails that make it into employees’ inboxes.
About Churchill Mortgage Corporation
Founded in 1992, Churchill Mortgage Corporation is a mortgage company based in Brentwood, Tennessee. The company provides residential customers with a wide range of mortgage options for home buyers as well as those looking to refinance their current homes. Churchill Mortgage Corporation is licensed to write mortgage loans in 49 states. Churchill Mortgage Corp. has more than 800 employees and brings in roughly $574 million each year in revenue.
