KeyBank key.com KeyBank data breach: what happened and what to do
Hackers who broke into KeyBank's mortgage insurance vendor, Overby-Seawell, on July 5, 2022 took mortgage customers' names, addresses, mortgage account numbers and the first 8 digits of Social Security numbers. KeyBank has not published a total number of people affected.
View all 13,177 breaches- Breach date
- 5 Jul 2022
- Made public
- 26 Aug 2022
- Data exposed
- Names, Physical addresses, Mortgage account numbers, Social security numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
The breach was at a vendor, not at KeyBank itself. Overby-Seawell, a company that handles insurance tracking for mortgage accounts, was hacked on July 5, 2022. KeyBank says the vendor told it on August 4. KeyBank then notified affected customers, and the notice was filed with state attorneys general including California and Washington.
On September 23, 2022, the vendor told KeyBank its investigation had found the incident also affected additional KeyBank mortgage accounts, and a supplemental notice followed.
Sources checked: oag.ca.gov, securityweek.com, atg.wa.gov
Last verified against the official page:
What was exposed
Per the notice letter, the data tied to the mortgage was the customer's name, address, mortgage account number and the first 8 digits of the 9-digit Social Security number.
KeyBank has not published a total. Washington's listing shows 54,295 Washington residents, which is one state only.
That is enough for convincing fraud attempts: a caller who knows your name, address and loan number can pose as your lender. Eight digits of a Social Security number is not the full number, but it makes guessing the rest far easier, so a freeze is sensible.
The company's response
Overby-Seawell notified law enforcement and brought in outside cybersecurity experts. KeyBank offered affected customers free fraud monitoring. A proposed class action naming both companies was filed in federal court in Ohio.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A credit freeze is free and stops anyone from opening new credit in your name. Set it up with Equifax, Experian and TransUnion. The FTC explains how: https://consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- 2
Be wary of anyone claiming to be your mortgage lender
Scammers who know your loan details can ask for payments or "verification". Call KeyBank only on the number on your statement or its official site, and never pay by gift card or wire at a stranger's request.
- 3
Watch your accounts and credit reports
Check statements for charges you don't recognize and pull free reports at annualcreditreport.com. If something is wrong, report it at identitytheft.gov.
- 4
Take up the free fraud monitoring
Use the offer in your notice letter, following the instructions in the letter itself.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases and the dark web for your email, phone and other details, and Serus keeps watching and alerts you if something new turns up.
Official filings
- Washington Attorney General , filed 26 Aug 2022 : 54,295 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to the Washington Attorney General
Frequently asked
Was KeyBank itself hacked?
No. According to its notice, the breach was at a vendor, Overby-Seawell, that handles insurance services for mortgage accounts.
What data was exposed in the KeyBank breach?
Name, address, mortgage account number and the first 8 digits of the Social Security number, per the notice letter.
How many people were affected?
KeyBank has not published a total. Washington's attorney general listing shows 54,295 Washington residents, which is only one state.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
