NFM Lending failed to protect borrower data, a new class action lawsuit claims.

Sheneka Smith filed a class action lawsuit against NFM Lending LLC in the U.S. District Court for the District of Maryland on Sept. 16, 2026.

The complaint claims the mortgage lender experienced a data breach that compromised customers' names, Social Security numbers and financial records.

The allegations

The NFM Lending breach reportedly occurred on or around Sept. 7, 2026. A cybercriminal group known as Interlock claimed responsibility for stealing more than 2.5 terabytes of data from the company's systems, affecting thousands of current and former clients.

The proposed class action claims NFM Lending had still not told clients about the incident on the date of the filing, leaving victims without the chance to freeze credit, flag accounts or otherwise limit the damage.

Interlock was able to access the NFM Lending network because the company did not adequately train employees on cybersecurity risk or keep reasonable safeguards in place, according to the lawsuit. It faults the lender for falling short of three widely used benchmarks: the NIST Cybersecurity Framework 2.0, the CIS Critical Security Controls and Federal Trade Commission data security guidance.

Smith claims she suffered anxiety and spent hours spent watching her accounts. The proposed class action alleges class members face a lasting risk of identity theft and fraud.

The legal claims

The lawsuit brings four claims against NFM Lending:


  • Negligence, which applies when a business owes a duty of reasonable care and falls short of it

  • Breach of implied contract, which covers the unwritten promise by companies to guard data customers turn over to receive a service

  • Unjust enrichment, a theory that a company should not keep payments for protection it never delivered

  • Maryland Consumer Protection Act, a state law barring unfair, abusive or deceptive trade practices, which the suit says the lender violated partly by ignoring the Maryland Personal Information Protection Act

Smith seeks damages, restitution, injunctive relief and attorneys' fees.

What this means for NFM Lending borrowers

The proposed class covers everyone in the United States whose private information the breach exposed, including past and current customers. As of this writing, there is no settlement, no claims process and no money available.