Typically, breach litigation has not been very successful. I would describe your outcome at very out of the ordinary (although the behavior you describe is pretty egregious).
The problem is that, generally, the law thinks in terms of damages. So this mortgage company was being reckless with private information, but were you harmed by it? If the answer is "no," oftentimes the claim is dead on arrival.
Of course, we all know that a data breach might not yield harm for 12+ months (when the data is sold on a black market and then used nefariously). But the law isn't well equipped for these types of situations.
The problem is that, generally, the law thinks in terms of damages. So this mortgage company was being reckless with private information, but were you harmed by it? If the answer is "no," oftentimes the claim is dead on arrival.
Of course, we all know that a data breach might not yield harm for 12+ months (when the data is sold on a black market and then used nefariously). But the law isn't well equipped for these types of situations.