Berkadia Commercial Mortgage LLC

Berkadia Commercial Mortgage LLC, one of the nation's largest commercial real estate lenders, was hit by a data breach that exposed personal information belonging to hundreds of thousands of people. The breach involved approximately 434,200 rows of records and is estimated to have occurred on or around March 19, 2026. The breach has been publicly linked to the ShinyHunters group, which claimed it obtained Salesforce records containing personal information and internal corporate data from the company after ransom negotiations failed. No company notice confirming the incident has been verified.

March 24, 2026: The ShinyHunters group listed Berkadia Commercial Mortgage on its leak site, claiming it held roughly 27 GB of compressed Salesforce records containing personal and internal corporate data, according to Ransomware.live.

April 13, 2026: A proposed class action, Todd v. Berkadia Commercial Mortgage LLC, was filed in the Southern District of New York alleging that ShinyHunters breached Berkadia's systems on or about March 20, 2026 and that affected individuals had not been notified, as reported by Mortgage Professional America.

What Information Was Compromised?

Our analysis found the following data types in this breach: 434,200 full names, 301,990 email addresses, 247,746 street addresses, 233,711 phone numbers, and 2,778 Social Security numbers.

The class action filing alleges that additional categories were taken, including dates of birth, driver's license and passport numbers, usernames and passwords, employment histories, banking information, and tax information. These allegations have not been independently confirmed.

Not every individual is affected by every type of data listed here.

What Are the Potential Risks for Affected Individuals?

For most people in the dataset, the exposure centers on contact details. Names, email addresses, phone numbers, and street addresses are commonly used to build convincing phishing messages and impersonation attempts, and they can help criminals target people with fake lender, employer, or IT communications that appear legitimate.

For the roughly 2,778 people whose Social Security numbers were exposed, the risks are more serious. An SSN combined with a name and address can be used for identity fraud, fraudulent credit applications, tax refund theft, and account takeovers. The proposed class action also claims passwords tied to employment accounts were among the stolen data, which could enable unauthorized access to work systems if the credentials were reused elsewhere.

What Is Berkadia Commercial Mortgage LLC Doing in Response?

As of the April 13, 2026 filing, the lawsuit alleged that Berkadia had not notified affected individuals, had not reported the breach to state attorneys general, and had not offered identity theft monitoring. According to Mortgage Professional America, Berkadia had not yet responded to the allegations, and no determination has been made on the merits of the case. The firm Mason LLP separately announced on March 25, 2026 that it was investigating a potential class action related to the incident.

What Should You Do If You Were Affected?

If you worked for Berkadia, received commercial real estate financing or servicing through the company, or had business dealings with it, take the following steps:

Be cautious with unexpected emails, calls, or texts that reference Berkadia, mortgage accounts, or employment matters. Attackers can use exposed contact data to sound credible.

Check whether your email address appears in this breach, and change any passwords you reused on other accounts, especially work-related ones.

Enable two-factor authentication on email, banking, and work accounts wherever it is available.

If you believe your Social Security number was involved, place a fraud alert or credit freeze with the three major credit bureaus and review your credit reports for accounts you do not recognize.

Watch for tax-related identity issues, such as a rejected tax return or an IRS notice about a return you did not file.

Monitor your bank and brokerage statements for unfamiliar activity and report anything suspicious promptly.

Keep any records about your dealings with Berkadia. If notices or credit monitoring are eventually offered, documentation of your relationship with the company may help you confirm eligibility.