Mr. Cooper Group Inc.

Item 8.01 Other Events On October 31, 2023, the Company determined that we had experienced a cybersecurity incident in which an unauthorized third party gained access to certain of our technology systems. Following detection of this incident, the Company initiated response protocols that included deploying containment measures involving shutting down certain systems as a precautionary measure. We have notified law enforcement, regulatory authorities, and other stakeholders, and we are working with our existing cyber security firms and retained additional cybersecurity experts to oversee our actions. Due to these and other measures, we believe we have contained the cyber threat. We restarted servicing operations on Saturday, November 4, 2023, to include taking customer calls and payments, remitting to investors, and onboarding new loans. We expect our originations systems to be fully operational shortly, following reestablishment of connectivity with vendors and agencies, and we have already resumed buying Mortgage Servicing Rights (“MSRs”). Because our systems were not accessible from November 1 through November 4, many customers were unable to make payments or access their accounts. We announced to customers that they will not be subject to late fees, penalties or negative credit reporting related to late payments as a result of this incident. We have initiated a thorough investigation to determine the cause and full extent of the incident. Our preliminary analysis found that certain customer data was exposed, however it will require additional analysis to validate this finding and quantify the scope and type of any such exposure. While we cannot presently quantify the full extent of remediation and legal expenses associated with this cyber attack, we do not believe th