SitusAMC turned a mid-tier mortgage vendor into a top-tier bank exposure

The week

Over the weekend of November 22, 2025, it became public that SitusAMC, a New York-based provider of services and technology to real estate lenders, servicers and investors, had been breached. The company said it became aware of the incident on November 12, notified law enforcement and brought in outside experts. It said corporate data relating to some clients’ relationships with it, such as accounting records and legal agreements, had been affected. Some data about clients’ customers might also be involved, with the scope still under investigation. It said no encrypting malware was used and its services remained operational. Press reports said JPMorgan Chase, Citi and Morgan Stanley were among the institutions notified, and the FBI said it was working with affected organizations.

Third-party breaches are familiar in banking. SitusAMC was instructive because of the kind of vendor involved. It is not a core processor or a cloud platform, and for many clients it is not a large line in the technology budget. Yet firms like it handle loan files, valuations, due diligence and servicing data for many institutions at once. Three procurement decisions determined how exposed each client was: how the vendor was tiered, what data was sent to it, and what the contract said about the day it was breached.

Tiering: why spend and criticality miss data-dense vendors

Third-party risk programs tier vendors to decide how much diligence each gets. Most tiering models weight contract value and operational criticality heavily. A core processor lands in the top tier because the bank cannot run without it. A specialist firm paid per loan or per engagement may land lower, even if it holds detailed borrower records.

The 2023 interagency guidance on third-party relationships from the Federal Reserve, FDIC and OCC expects risk management proportionate to the risk a relationship presents, and it names access to sensitive customer information as a factor. Many models give that factor a single checkbox. A better design scores it separately, using the volume and sensitivity of the records held.

Two tests help. First, ask for each vendor how many customers the bank would have to notify if everything sent to that vendor were published tomorrow. Second, ask whether a breach would stop operations. SitusAMC illustrates a vendor that scores low on the second test and high on the first. Under a criticality-led model, it gets light-touch review. Under a data-led model, it gets security assessments, evidence of access controls and logging, and a named relationship owner.

There is also a sector-level effect. A shared vendor concentrates many institutions’ data in one place. Each bank sees one modest relationship. An attacker sees a single target holding data on borrowers from dozens of lenders. Tiering models built bank by bank do not capture that concentration, so banks should ask vendors directly how many financial institutions they serve and whether client data is segregated.

Tiering also has to move with the data. A vendor that started with a narrow valuation task can, two years later, be receiving full servicing files because a business line expanded the engagement. Few programs re-tier on that kind of change, because the contract value may barely shift. A practical trigger is any new data feed or new data category sent to an existing vendor. That requires the teams that set up file transfers to tell third-party risk when a new feed goes live. Some banks route every outbound file transfer through a managed gateway partly so that this signal is captured automatically.

Data: what you send is what you can lose

Mortgage and real estate finance runs on documents. Loan tapes, appraisals, title files, servicing records and legal agreements move between lenders, servicers, investors, diligence firms and valuation providers. Each transfer has a business reason. Over time, vendors accumulate far more than any one task needs, and keep it after the task ends.

Minimization at the point of transfer is the cheapest control available. A diligence review of a loan pool may need loan-level performance data but not full Social Security numbers. A valuation may need a property address but not the borrower’s income documents. Masking or tokenizing identifiers before transfer, and sending files through a managed channel rather than ad hoc email or shared folders, shrinks what a breach can expose.

The obstacle is organizational, not technical. The capital markets or servicing team sending a file is measured on closing the deal, not on the fields in the file. Data owners in the bank rarely see these transfers. A workable fix is a short data specification attached to each statement of work, approved by the data owner, with retention limits and a destruction certificate at the end of the engagement. Spot checks of a few vendors a year show whether the certificates mean anything.

Contract: who learns, who pays and who tells customers

When a vendor is breached, the bank still owns its obligations to its customers. Several contract terms carry real economic weight.

• Notice that does not depend on disruption. The federal bank incident notification rule that took effect in 2022 obliges bank service providers to notify banks of incidents that disrupt or degrade service for four or more hours. SitusAMC said its services kept running. Even where a vendor counts as a bank service provider under that rule, a data theft without an outage falls outside it. The contract must require prompt notice of suspected unauthorized access to client data on its own terms.
• Cooperation and information. The bank needs enough detail, quickly, to decide which customers are affected and under which state laws. The contract should require the vendor to identify affected records by client and to share the forensic findings relevant to the bank’s data.
• Who sends notices and who pays. Contracts should settle whether the vendor or the bank notifies customers, who approves the letter, and who bears notification, call center and credit monitoring costs. Vendor insurance should be large enough to make the promise credible.

These terms are negotiable at signing and very hard to add after an incident. For a data-dense vendor, procurement should treat them as standard rather than as concessions reserved for the largest relationships. Banks with dozens of similar vendors can use a standard data-protection addendum so that the terms do not depend on each business line’s negotiating effort.

With hindsight

The early descriptions of the breach focused on corporate records. Notification letters sent to individuals in 2026, filed with state attorneys general, showed a wider picture for some people: depending on the person, names, addresses, dates of birth, government identification numbers and financial account information. SitusAMC said it had determined that data was taken from specific systems in mid-November 2025, and that it was not aware of fraudulent use. Class action litigation followed, and a proposed $5.3 million class settlement was before the federal district court in Manhattan by mid-2026.

The gap between an initial “corporate data” framing and later individual notices is the useful part for buyers. Banks that knew exactly which files they had sent, and could match the vendor’s findings to their own records, could judge their customer obligations quickly. Those relying on the vendor’s assessment waited months. Tiering by data, minimizing transfers and contracting for record-level cooperation are what shorten that wait.