The mortgage lender said the hack was caused by a third-party’s vulnerability.