What Happened?
On or about May 16, 2025, HMA Mortgage became aware of unauthorized access to its systems. Upon detection, HMA launched an investigation with the assistance of third-party cybersecurity experts to determine the nature and scope of the incident. The investigation determined that an unauthorized third party gained access to HMA’s network between April 25, 2025, and May 15, 2025, and may have accessed and acquired certain files stored on its systems.
HMA conducted a comprehensive forensic investigation and manual document review to determine what information was compromised and identify affected individuals. On November 25, 2025, HMA determined that impacted files contained sensitive personal and protected health information.
On February 18, 2026, HMA filed a notice with the Attorney General of Massachusetts. HMA has also posted public notice of the breach on its company website.