Attorney General Ellison reaches settlement over $2.3B in attempted unauthorized withdrawals

ACI Worldwide will pay $10M total, with Minnesota receiving $119K

Within the last three weeks, Ellison’s Office has returned almost $1 million to Minnesota in data-breach settlements alone

October 23, 2023 (SAINT PAUL) — Minnesota Attorney General Keith Ellison joined a coalition of 49 attorneys general in announcing a settlement with payment processor ACI Worldwide over a 2021 testing error that led to the attempted unauthorized withdrawal of $2.3 billion from the accounts of over 477,000 mortgage-holders. As part of the settlement, ACI will pay $10 million to the states, including $119,718.60 to Minnesota.

ACI Payments, a subsidiary of ACI Worldwide Corp., is a payment processor for a variety of third-party clients, including mortgage servicers. Nationstar Mortgage, known publicly as Mr. Cooper, offered ACI’s Speedpay product to its customers so they could schedule and electronically pay their monthly mortgage payments through the Automated Clearing House (ACH) system.

On April 23, 2021, ACI was testing the Speedpay platform when it erroneously submitted live Mr. Cooper consumer data into the ACH system. This resulted in ACI erroneously attempting to withdraw mortgage payments from hundreds of thousands of Mr. Cooper customers on a day that was not authorized or expected. In many cases, consumers were subjected to the attempted withdrawal of multiple mortgage payments from their personal bank accounts. While the vast majority of withdrawals did not ultimately go through or were reversed, 1.4 million transactions totaling $2.3 billion were processed, impacting over 477,000 Mr. Cooper customers. While ACI took corrective steps to minimize the impact of the testing error, in some cases consumers were not able to access the money at issue and were forced to incur overdraft or insufficient funds fees. Impacted consumers have received restitution from ACI and through other related settlements.

“Consumers trust that payment processing companies will only take money from their bank accounts when they have permission to do so,” said Attorney General Keith Ellison. “ACI violated that trust and the law. With this settlement, we are holding them accountable and ensuring they put systems in place so this will not happen again.”

The investigation determined that the April 2021 incident was possible due to significant defects in ACI’s privacy and data security procedures and technical infrastructure related to the Speedpay platform. Today’s settlement requires ACI to take steps to avoid any future incidents, including requiring ACI to use artificially created data rather than real consumer data when testing systems or software, and requiring ACI to segregate any testing or development work from its consumer payment systems.

On October 5, Attorney General Ellison announced a data breach settlement with Blackbaud, which agreed to pay Minnesota almost $800,000 after 400 TB of private data was stolen from the company. Earlier on October 23, Attorney General Ellison announced data breach settlement with Inmediata, who will pay over $90,000 to Minnesota for exposing the private health data of 113,208 Minnesota residents. Between these three recent settlements with ACI, Blackbaud, and Inmediata, Minnesota will receive almost $1 million thanks to Attorney General Ellison’s Office.

Joining Attorney General Ellison in the settlement with ACI are the attorneys general of 49 states and territories, including Alabama, Alaska, Arizona, Arkansas, California, Colorado, Connecticut, Delaware, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Mississippi, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Texas, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin, Wyoming, the District of Columbia, and Puerto Rico.