The Money Store Faced Two Class Action Lawsuits
Plaintiffs allege the firm failed to meet federal security standards following an identified ransomware intrusion.
Updated on Oct. 12, 2026 in Cybersecurity
Live Poll
Do you trust companies to adequately protect the sensitive personal information you provide them?
Two class action lawsuits have been filed against The Money Store following allegations that the company failed to protect sensitive borrower data. The actions follow reports that the Storm ransomware group added the company to its list of victims in September 2026.
Why it matters
The litigation highlights the legal liabilities associated with failing to adhere to established federal cybersecurity benchmarks when handling sensitive personal financial records. It underscores the growing industry risk of double extortion, where attackers combine data encryption with threats to leak stolen information.
The lawsuits allege that The Money Store failed to implement reasonable protections in accordance with the NIST Cybersecurity Framework. Plaintiffs report tangible damages including increased spam communications and personal costs associated with purchasing credit monitoring services.
The players
The Money Store
A financial services company that manages loan documents and borrower financial accounts.
Storm
A ransomware group known for employing double extortion tactics to target data for encryption and unauthorized publication.
The details
The Storm ransomware group allegedly employed double extortion tactics, a method where attackers both encrypt victim data to disrupt operations and threaten to publish the stolen material online. The filings allege that The Money Store did not meet the NIST Cybersecurity Framework, a set of voluntary, consensus-based standards developed by the National Institute of Standards and Technology to manage and reduce digital security risk. Compromised information reportedly includes names, Social Security numbers, financial account details, and loan documents.
Timeline
Storm allegedly began numerous data breaches in August 2026.
Storm listed The Money Store as a breach victim on September 22, 2026.
The Tech Race
The litigation centers on adherence to the NIST Cybersecurity Framework, which serves as the primary benchmark for assessing whether a company’s security measures are reasonable. It reflects a broader trend of shifting the burden of data protection onto financial institutions via litigation when voluntary frameworks are bypassed.
Borrowers impacted by this event face potential exposure of Social Security numbers and financial account details. Affected individuals are currently dealing with the need for credit monitoring services to mitigate the risk of identity theft resulting from the breach.
The takeaway
These filings mark a push to hold firms accountable for failing to align internal protocols with the NIST Cybersecurity Framework. Affected borrowers should monitor their credit reports closely and watch for court rulings regarding the certification of the proposed nationwide class.
Further reading
For broader context on how digital safety standards impact legal outcomes, explore Cybersecurity.
Source note: This article includes information reported by Mortgage Professional America Magazine.
Live Poll
Do you trust companies to adequately protect the sensitive personal information you provide them?
