Benworth Capital Partners negotiated with threat actors after more than 25,000 lenders had data stolen

According to DataBreaches[.]Net, Benworth Capital Partners PR LLC, a licensed Florida hard money lender, negotiated with unnamed threat actors after more than 25,000 lenders had data stolen. The cybersecurity incident is said to have occurred on or about 18 May 2025, with notification letters sent to those affected on 16 September 2025.

Benworth states it negotiated for the return and deletion of the stolen files and has been monitoring the dark web, reporting no indication that data had been disseminated as of that date. The affected files included loan-related information such as borrower name, address, taxpayer identification number, phone number, loan account number, maturity date, closing date and loan amount, and the company offered identity theft protection services from IDX.

A copy of the letter was submitted to the California Attorney General’s Office on 31 October 2025, and as of today no group has publicly claimed responsibility for the attack. The incident reportedly affected 943 Oregon residents, 22,895 Texas residents and 1,230 Massachusetts residents, with total numbers not publicly disclosed.