Impac Mortgage Holdings is on the verge of going out of business, according to a new audit.

The Southern California–based mortgage firm revealed its dire situation via an independent audit from Baker Tilly published Friday to the over-the-counter Open Market exchange. Once regularly a billion-dollar originator, the company's books today are upside-down, with forbearance agreement deadlines in June. 

"There can be no assurance that the forbearance will be extended past June 1, 2026," the audit read. "As a result, there is substantial doubt about the company's ability to continue as a going concern."

Impac, which repositioned itself as a mortgage brokerage in 2023, reported just over $1 million in broker fee income in 2025 as it posted $3.1 million in total revenue. According to the audit, the lender counted a $12.9 million net loss last year, and faces massive debts as part of its complicated financial picture. 

Additionally, the business also disclosed Friday that it suffered a monthslong data breach in 2024, affecting an untold number of customers. 

Impac General Counsel Joe Joffrion did not respond to requests for comment Monday. 

Why Impac is in trouble

The non-qualified mortgage lender, founded in 1995, was battered by several macroeconomic factors this decade, beginning with a disastrous halt in lending and investor pullback with the onset of the coronavirus pandemic. It suffered another blow as interest rates began their steep and steady climb from pandemic lows, and as it shifted its business model away from the wholesale and consumer direct space. 

The lows continued in 2023, as the company was delisted from the New York Stock Exchange's American exchange that April. Its operations have waned since. 

The recent audit shows Impac had $45 million in operating liabilities through the end of 2025 against $22.5 million in assets, the majority of that in its corporate-owned life insurance cash surrender value. The lender counts just $6.4 million in cash and cash equivalents. 

Impac has extended a forbearance agreement for a $20 million revolving credit facility several times with its debt holders, with the newest expiration on June 1. 

According to the audit, the firm also owes a $62 million debt from two junior subordinated indenture notes issued in May 2009 in the wake of the Great Financial Crisis. Impac defaulted on that interest payment in January 2024, and its forbearance period for those notes also ends in June. 

Per Nationwide Multistate Licensing System records, the company has seven sponsored mortgage loan originators via its CashCall Mortgage brand and is still licensed to originate in California, Florida, Nevada, New Jersey and Texas. 

The data breach

Impac disclosed its cybersecurity incident in a notice to the Office of the Maine Attorney General, and shared very few details of the hack. The company did not publish the total number of consumers affected nationwide, as required by the AG's office, but did say the intrusion occurred between Feb. 21, 2024 and March 20, 2024. 

Customers' names and Social Security numbers may have been compromised by the unauthorized user in its servers, Impac said in its letters to affected consumers. Like other firms responding to breaches, Impac offered victims complimentary credit monitoring services for 12 months.