SAINT PAUL, MN:  The Minnesota Department of Commerce has joined financial regulatory agencies in states across the U.S. to take coordinated action against mortgage company Bayview Asset Management LLC., and three of its affiliates, Lakeview Loan Servicing, Community Loan Servicing, and Pingora Holdings (collectively the Bayview Companies), for deficient cybersecurity practices and failing to respond to regulator inquiries in a timely manner following a data breach that impacted 5.8 million customers.  

The $20 million settlement and corrective plan is the first collective multistate enforcement action by state regulators for a mortgage company data breach. This enforcement action underscores the importance of protecting consumer data and complying with state regulations.  

“This settlement shows the critical need for businesses to protect consumers’ personal and financial data to prevent a data breach and to protect consumers in case there is a data breach,” said Minnesota Commerce Assistant Commissioner of Enforcement Jacqueline Olson. “More Minnesota mortgages are now managed by nonbanks than traditional banks. To protect consumers who rely on nonbanks for financial services, our state has been a national leader in modernizing how we regulate nonbanks.”  

In 2024, Minnesota became the first state in the U.S. to adopt all three model laws established through the Conference of State Bank Supervisors as described in this recent news post, including the Nonbank Model Data Security Law (Minnesota Commerce press release) that provides new protections to Minnesota consumers who provide sensitive data to nonbank companies.  

The multistate examination found that Bayview Companies’ information technology and cybersecurity practices did not meet federal or state requirements. Furthermore, the Bayview Companies delayed the process by failing to comply with state requests in a timely and complete manner.  

In addition to the monetary penalty, the Bayview Companies agreed to take specific corrective actions, improve cybersecurity programs, undergo independent assessments, and provide three years of additional reporting to the states.  

Through the Nationwide Multistate Licensing System, state financial regulators, including the Minnesota Department of Commerce, license and supervise more than 33,000 nonbank financial services companies, including mortgage companies, money services businesses, consumer finance providers, and debt collectors.  

Additional Resources:  

• Conference of State Bank Supervisors press release Jan. 8, 2025: State Regulators Levy $20 Million Penalty on Nation’s Largest Nonbank Mortgage Servicing Company 
• Conference of State Bank Supervisors YouTube animated video: What is a Non-Bank?   
• Minnesota Commerce: Non-Depository Information Security and Incident Notification  

Minnesota Department of Commerce Enforcement - The Minnesota Department of Commerce works to assist and protect consumers, and to ensure a strong, fair marketplace. Minnesota consumers and businesses can contact Commerce’s Enforcement Division about concerns or complaints:  

• File a complaint online  
• Email: consumer.protection@state.mn.us
• Verify whether a financial services company is licensed to do business in Minnesota: License Lookup. 
• Search Commerce Actions and Regulatory Documents to view past enforcement actions. 

Connect with the Minnesota Commerce Department
Get updates and news from the Minnesota Department of Commerce by following Commerce at mn.gov/commerce or @MNCommerce on social media.

Contact
Mo Schriner
Minnesota Department of Commerce
651-363-1227
mo.schriner@state.mn.us