2022 KeyCorp / KeyBank — Overby-Seawell vendor breach; mortgage customer PII
Data compromised
Mortgage customer identifiers and partial SSN fields per KeyBank victim communications
Technical writeup
KeyBank notified residential mortgage customers that July 5, 2022 intrusion into Overby-Seawell Company (an insurance/tracking services vendor used across financial institutions) exposed mortgage-centric records including name, address, mortgage account number, and the first eight digits of Social Security numbers in sample customer letters summarized by Associated Press and SecurityWeek. KeyBank declined to publish a total affected population in the same reporting cycle and stated native KeyBank systems were not breached.
Root cause
Third-party service provider compromise enabling access to shared mortgage-insurance workflow data