Mortgage data appear briefly online

From the Seattle Post Intelligencer

Thursday, November 16, 2000

___________________________________________________________

 By D. IAN HOPPER
THE ASSOCIATED PRESS

WASHINGTON -- A security breach in the software used by many mortgage brokers caused at least 700 Americans loan applications -- including Social Security numbers -- to be divulged on the Internet, officials said yesterday.

Though quickly rectified, the breach should send a warning through an industry that now processes one of every three mortgage applications electronically using software made by California-based Contour Software, security and loan experts said.

"It's of great concern to us," said Tom Lovell, president of AMEX Mortgage in Tempe, Ariz., a mortgage broker whose customers applications were divulged on the Web because of the software problem.

"We've been evaluating new services, and this gives us more cause for that," he said.

The breach, discovered by a computer security firm, angered homeowner Ronald Johnson, who comparison-shopped for mortgages online and learned that his application was visible on the Internet. It included his and his wife's Social Security numbers, lists of assets and work history.

"I really don't buy anything online, because I'm afraid if I put my credit card number on there, it's going to be all over the world," Johnson said from his Fountain Hills, Ariz., home.

"But when we applied for a loan for this house, I thought it would be a good time to use the Web. I guess I was wrong about that, too."

Contour Software's Scott Cooley blamed a disgruntled former employee, who turned off security settings for a computer directory where the loan applications were stored.

"Keep in mind that it would have been impossible to find this directory without knowing it by name," Cooley said. He said the problem was fixed and appears to have involved at least 700 customers from at least 27 mortgage brokers who use the company's software.

As of late yesterday afternoon, the loan applications were no longer visible on the Internet. Cooley said he didn't know how long the information had been available before the security firm discovered it.