Borrower sues Gold Star Mortgage a day after ransomware gang claims data theft

A ransomware group says it hit Gold Star Mortgage Financial Group - and a class action followed within 24 hours.

A former borrower has sued Gold Star Mortgage Financial Group in federal court, alleging the lender failed to protect the personal data of thousands of current and former customers from a cyberattack that a notorious ransomware gang has already claimed as its own.

The lawsuit, filed September 25, 2026, in the US District Court for the Eastern District of Michigan, alleges the Ann Arbor-headquartered residential mortgage lender and servicer stored sensitive borrower information - names, Social Security numbers, addresses, and details - without adequate encryption or security controls. The filing says the breach occurred on or around September 24, 2026. The suit landed the very day.

The cybercriminal group BrainCipher has claimed responsibility for the attack, according to the filing. The suit says BrainCipher claims to have pulled more than 10,300 documents from Gold Star's IT network.

The borrower behind the suit says she was a former Gold Star customer who handed over her personal information as a condition of receiving a loan. Since the breach, she alleges she has experienced "a sharp uptick in suspicious spam emails and calls" and received alerts that her data "was discovered on the Dark Web," according to the filing. She says she now checks her financial and credit statements multiple times a week.

The lawsuit describes a lender that collected highly sensitive financial data from borrowers but allegedly fell short on the security infrastructure to protect it. The filing alleges Gold Star did not use phishing-resistant multi-factor authentication, did not encrypt stored data, did not maintain adequate monitoring or alert systems, and did not properly train employees on cybersecurity. The suit goes further, alleging the lender kept borrower data long after the customer relationship ended - and left it sitting on its network "in a condition vulnerable to cyberattacks."

Gold Star knew - or should have known - its systems would be attractive targets for cybercriminals, the suit alleges, given the volume and sensitivity of borrower data it held. The filing says the lender "failed to recognize the Data Breach until cybercriminals had already accessed" borrower information, meaning it "had no effective means in place to ensure that cyberattacks were detected and prevented."

The filing points to a stack of federal cybersecurity benchmarks it says Gold Star failed to meet: FTC guidelines on data protection, the NIST Cybersecurity Framework, the Center for Internet Security's Critical Security Controls, and CISA recommendations for defending against intrusions.

The class action seeks to represent all US residents whose personal information was compromised - a group the filing estimates at "at least thousands" of individuals. The aggregated claims exceed $5 million, according to the suit.

The borrower is pursuing five legal theories, from negligence to consumer protection claims under Michigan's Consumer Protection Act. She is asking for compensatory and punitive damages, along with court orders that would force Gold Star to overhaul its security systems, submit to annual audits, and provide lifetime identity theft protection to every affected borrower.

For lenders and servicers holding borrower data, the timeline here is the story within the story. This suit was filed one day after the alleged breach, with a named ransomware group already claiming credit. The window between a cyber incident and a courtroom filing is getting shorter - and plaintiffs' firms are clearly watching ransomware disclosures in real time.

The allegations in this lawsuit have not been proven, and no court has made any findings or rulings in this case.