Notice of Data Event

Cybersecurity Incident Notification

Mortgage Investors Group (MIG) recently completed an investigation into a cybersecurity incident involving unauthorized access to its network.

On December 12, 2024, MIG discovered that an unauthorized individual accessed its computer systems using stolen employee credentials. Upon discovery, MIG immediately secured its systems and engaged independent cybersecurity professionals to conduct a comprehensive forensic investigation.

Following the conclusion of the investigation, MIG worked to identify the types of information at risk, the identities of potentially affected individuals and the accuracy of their mailing addresses, and ensure that written notifications were delivered to the correct individuals. This verification process, along with preparation of notification materials and coordination with third party service providers, occurred prior to mailing notification letters on December 30, 2025.

What Happened

The investigation determined that an unauthorized actor accessed certain files within MIG’s computer environment between December 11 and December 12, 2024. Access was terminated the same day the activity was detected.

MIG worked closely with cybersecurity specialists to understand the nature and scope of the incident, identify potentially affected individuals, and determine what types of information may have been involved.

What Information Was Involved

The information involved varied by individual. For some people, the information may have included a name along with one or more of the following:

• Driver’s license number
• Social Security Number
• Banking or financial account information
• Other limited personal or financial data

Not all information applied to all individuals.

What We Did

After discovering the incident, MIG took the following actions:

• Secured its systems to prevent further unauthorized access
• Engaged independent cybersecurity experts to investigate
• Conducted a detailed review to identify affected individuals and the types of information potentially at issue
• Reported the incident to law enforcement and cooperated fully
• Implemented additional safeguards across its network

Once the investigation and review were complete, MIG provided written notification to individuals whose information may have been involved, as required by law. This letter was mailed on December 30, 2025.

Credit Monitoring & Identity Protection

MIG is providing complimentary credit monitoring, identity theft monitoring, and identity theft insurance to individuals who were notified. These services are administered by Cyberscout, a TransUnion company, and are offered at no cost.

At this time, MIG has no evidence that any personal information has been misused as a result of this incident. The company has not received any reports of identity theft associated with this matter.

How to Enroll in Credit Monitoring

To enroll in complimentary credit monitoring services, please visit:

https://bfs.cyberscout.com/activate

Follow the instructions on the site. When prompted, enter the unique activation code included in the letter mailed to you. The code is case sensitive and must be entered exactly as it appears.

If you are unable to locate your letter, please contact TransUnion Support. Their team can assist you with enrollment.

MIG TransUnion Support Phone Number:
833 833 3892

Hours:
Monday through Friday (except holidays)
8:00 AM to 8:00 PM EST

Enrollment Timing

To receive the protection services described above, enrollment must be completed within 90 days from the date the letter was mailed.

All notification letters were mailed on Tuesday, December 30, 2025.

What You Can Do

While there is no indication of misuse, we encourage you to remain vigilant as a precaution. Steps you may consider include:

• Monitoring bank and credit card statements for unusual activity
• Reviewing credit reports regularly
• Filing your tax return as early as possible
• Placing a fraud alert or credit freeze if you choose
• Enrolling in the complimentary monitoring services if you received a notification letter

You are entitled to one free credit report each year from each of the three major credit bureaus by visiting www.annualcreditreport.com or calling 877 322 8228.

Credit Bureau Resources

You may contact the nationwide credit reporting agencies directly for additional information or to place a fraud alert or security freeze.

• Equifax
  P.O. Box 740241, Atlanta, GA 30374
  1 800 685 1111
  www.equifax.com
• Experian
  P.O. Box 9532, Allen, TX 75013
  1 888 397 3742
  www.experian.com
• TransUnion
  P.O. Box 2000, Chester, PA 19016
  1 800 916 8800
  www.transunion.com

Remove your name from mailing lists of pre-approved offers of credit for approximately six months. If you aren’t already doing so, please pay close attention to all bills and credit-card charges you receive for items you did not contract for or purchase. Review all your bank account statements frequently for checks, purchases, or deductions not made by you.

Support Through TransUnion

For questions related to credit monitoring or identity protection services associated with this incident, we recommend contacting TransUnion, which is administering these services on behalf of MIG.

MIG TransUnion Support Phone Number:
833 833 3892

Hours:
Monday through Friday (except holidays)
8:00 AM to 8:00 PM EST

Contact Us

For assistance related to credit monitoring and identity protection, contacting TransUnion first is the fastest way to get support.

If you would like to contact MIG leadership or request follow up from our internal Care and Response team, please email:

privacy@migonline.com

Our Commitment

Protecting personal information is a responsibility MIG takes seriously. MIG has strengthened its security controls and continues to evaluate and enhance its safeguards.

We regret any concern this incident may cause and appreciate the trust placed in us.