Several of the United States’ largest financial institutions spent Saturday night racing to understand the implications of a significant cybersecurity breach at one of their key service providers. The incident, involving New York–based vendor SitusAMC, has raised concerns across the banking sector because the compromised system contains vast amounts of confidential mortgage-related information used by hundreds of lenders nationwide.

SitusAMC confirmed that it had been targeted in a cyberattack on November 12. According to the company, teams have worked continuously for nearly two weeks to determine how the attackers gained access and what types of data may have been taken. Early internal assessments suggest that the compromised information relates primarily to residential mortgage loan files.

People familiar with the matter said that JPMorgan Chase, Citi, and Morgan Stanley were among the institutions notified that some of their client information may have been exposed. These individuals were not authorized to comment publicly because the investigation is ongoing. The banks themselves declined to detail the scope of their potential exposure. A spokesperson for JPMorgan emphasized that the incident did not involve a direct intrusion into the bank’s own systems.

SitusAMC’s chief executive, Michael Franco, issued a statement noting that the company has alerted federal law enforcement and is continuing a thorough review of the data involved. He emphasized that determining the exact extent of the breach remains the company’s primary focus.

On the federal side, FBI Director Kash Patel addressed the situation in a brief statement. He indicated that although the investigation is still in its early stages, authorities have not identified any operational disruption to banking activities. Patel added that the FBI is working closely with affected organizations to gain clarity on the potential impact.

Cyber incidents targeting financial and business sectors have become increasingly common, but experts note that this breach is particularly troubling because of the type of information SitusAMC handles. The company plays a central role in the U.S. mortgage ecosystem, housing an enormous repository of personal details collected during loan origination and underwriting—details that routinely include Social Security numbers, financial statements, property records, and other sensitive data.

Given the magnitude of the potential exposure, SitusAMC has been issuing frequent updates to its customers as investigators analyze which systems were accessed and which data sets were compromised. The company employs about 5,000 people and is backed by multiple private equity firms, making it one of the largest service providers operating in the mortgage technology and compliance sector.

Industry analysts say that SitusAMC’s position in the market means that the incident could have far-reaching implications. Jon Winick, chief executive of Clark Street Capital, described the company as a fundamental part of the real estate finance infrastructure. He noted that most major lenders rely on the firm for various behind-the-scenes functions essential to both commercial and residential lending.

According to Winick, any bank involved in issuing real estate loans—whether commercial mortgage-backed securities or standard residential financing—likely interacts with SitusAMC in some capacity. He explained that although the company’s work may not appear glamorous, it forms the “necessary plumbing” of the industry, ensuring that loans are processed, recorded, and monitored correctly. Because SitusAMC touches so many stages of the lending process, a breach of its systems creates a unique cybersecurity challenge for banks.

Beyond the personal data of consumers, experts warn that the breach could affect highly sensitive internal banking information. SitusAMC assists lenders with regulatory compliance and risk-monitoring activities, which means it has access not just to loan applications but also to confidential assessments of banks’ real estate portfolios.

Jason E. Kuwayama, an attorney who specializes in banking regulatory issues, emphasized this broader risk. He explained that the potential exposure is not limited to customer data. SitusAMC’s involvement in compliance operations means that confidential insights into banks’ internal risk modeling and asset evaluations could also be vulnerable. According to Kuwayama, such information—if accessed by malicious actors—could reveal intricate details about how individual institutions assess and manage mortgage-related risks.

He noted that this raises a different level of threat, since attackers who gain access to internal risk assessments might infer strategic vulnerabilities or market positions. For financial institutions that already face pressure to maintain strict cybersecurity protocols, the idea that a third-party vendor breach could compromise internal data adds another layer of urgency.

In recent years, banks have significantly expanded their reliance on outside vendors to streamline operations and meet increasingly complex regulatory demands. While this model has enabled more efficient processes, it has also created a web of interconnected systems that can amplify the consequences of a single security flaw. The SitusAMC breach serves as a stark reminder of how deeply these service providers are embedded in the modern financial system.

Security specialists point out that supply-chain attacks—where hackers target smaller partners or service firms rather than the banks directly—have become a preferred tactic among cybercriminals. Such incidents are often harder to detect because they exploit trusted relationships between institutions and their vendors. In this case, the breach underscores the vulnerability of outsourced data-handling infrastructure and the difficulty banks face in monitoring every link in their digital ecosystem.

Banks affected by the incident are expected to conduct internal reviews to identify which customers’ information may have been processed through SitusAMC systems. Although there is no evidence yet that the stolen data has been misused, the breadth of personally identifiable information associated with mortgage applications makes the situation particularly serious. Mortgage documents, unlike credit card data, often contain a combination of personal identifiers and financial details that cannot be easily replaced or changed.

Regulators will likely take a close look at the incident as well. In recent years, federal agencies have pushed banks to strengthen oversight of their third-party vendors, especially those handling sensitive information. The breach could intensify calls for stricter standards, more detailed audit requirements, and greater transparency around how vendors manage cybersecurity risks.

For now, the full scale of the breach remains unclear. SitusAMC and federal investigators are continuing to analyze the compromised systems, and banks are preparing to notify customers if their data turns out to be among the material accessed by attackers. As the investigation unfolds, the incident may spark broader debate within the financial industry about the resilience of its digital infrastructure and the challenges of balancing efficiency with security in a highly interconnected system.