Payroll, RealEstate & Finance · Loan Marketplace · Structural / no discrete incident
LendingTree
Headline
Multiple confirmed breaches across several years, and the repetition is the finding rather than any single incident.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Multiple confirmed breaches across several years, and the repetition is the finding rather than any single incident. LendingTree's entire business model is collecting a consumer's financial profile and distributing it to multiple lenders who then compete - which means the data is designed to be shared widely, and a single form submission propagates to companies the consumer never named and cannot enumerate afterward. Comparison-shopping platforms of this kind are structurally the opposite of data minimisation: dispersal is the product.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
A 2008-09 multidistrict data-breach litigation against LendingTree (In re LendingTree Customer Data Security Breach Litigation) is reported to have involved enforcement of LendingTree's arbitration clause; the ruling was NOT verified this pass from the court record, so do not rely on it as precedent without checking the docket.
Data sharing
MULTIPLE CONFIRMED BREACHES ACROSS SEVERAL YEARS: (1) A February 2022 breach exploited a 'code vulnerability' in LendingTree's own systems, exposing names, Social Security numbers, birthdates, and addresses of about 200,000 consumers — per the plaintiffs' allegations, LendingTree waited MORE THAN FOUR MONTHS to disclose it to affected consumers and, per the lawsuit, understated the breach's true scope when it finally did. LendingTree agreed to settle the resulting class action (named plaintiffs Christopher Lamie and Amabel Lin) for $875,000; the deal received preliminary court approval in September 2023, with reported benefits including reimbursement of documented losses up to $10,000 and lost-time payments up to $250 (credit-monitoring terms not verified this pass). (2) Reports of additional LendingTree incidents in the same period, and of a disputed threat-actor data posting, could not be verified this pass and are omitted pending a source. (3) SEPARATELY, LendingTree's subsidiary QUOTEWIZARD was also affected by the broader 2024 SNOWFLAKE-linked breach wave that hit numerous companies using Snowflake's cloud data platform.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy lendingtree.com/legal/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service lendingtree.com/legal/terms-of-use | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.