Skip to content
Leak-site post naming MCAP — MortgageHub commercial lending platform, captured by ThreatCluster

MCAP — MortgageHub commercial lending platform

n0n

Ransomware leak-site victim intelligence · EN

Posted
Sep 30, 2026
Country
Canada
Industry
Mortgage securitization and servicing

Summary

Written by ThreatClusterfrom victim profile, leak post

n0n claims to have leaked the complete MortgageHub borrower database of MCAP, a major Canadian mortgage company, spanning seven years of records with sensitive personal data (social insurance numbers, dates of birth, full addresses) and complete loan and payment histories. The leak also claims the daily commercial servicing book—the full national portfolio of active commercial mortgages—with balances, interest rates, credit scores, insurer policy numbers, arrears, and investor reporting fields; and the full backup archive of the platform from 2019 through today. The leak's publication status is countdown.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

What was taken

The complete MortgageHub borrower database of a major Canadian mortgage company: seven years of records with social insurance numbers, dates of birth, full addresses, and complete loan and payment histories. The daily commercial servicing book: the full national portfolio of active commercial mortgages with balances, interest rates, credit scores, insurer policy numbers, arrears, and investor reporting fields. The full backup archive of the platform, 2019 through today.

Data categories
PIIDatabasesContractsFinancial data
Leak site tags
ActiveMCAP

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture