SACRAMENTO – The California DFPI and 52 state financial regulatory agencies have taken a coordinated action against mortgage company Bayview Asset Management LLC, and three of its affiliates, levying a $20-million fine against the company.
The California Department of Financial Protection and Innovation (DFPI) assessed the fine, citing deficient cybersecurity practices and not fully cooperating with state regulators following a data breach that impacted 5.8 million customers.
“The $20 million fine and corrective plan contained in the final settlement highlights the importance of meeting state requirements to protect consumer data and complying with state supervisory demands,” the DFPI said.
Bayview’s affiliates are Lakeview Loan Servicing, Community Loan Servicing, and Pingora Holdings (collectively the Bayview Companies).’
“Lenders and servicers have a responsibility to protect consumer data and work with state regulators when a breach, intentional or otherwise, occurs” said Acting Commissioner KC Mohseni. “California was proud to help lead the effort alongside partner states and the Conference of State Bank Supervisors in holding Bayview Asset Management accountable for the data breach and to correct identified cyber security deficiencies.”
State regulators in California, Maryland, North Carolina, and Washington State led the multistate effort, which found that Bayview Companies’ information technology and cybersecurity practices did not meet federal or state requirements. Furthermore, the Bayview Companies delayed the supervisory process by failing to comply with state requests in a timely and complete manner in the early stages of the examination, the DFPI said.
In addition to the monetary penalty, the Bayview Companies have agreed to take specified corrective actions, improve cybersecurity programs, undergo independent assessments, and provide three years of additional reporting to the states, the DFPI said.