Warning Recent Car Buyers—5.6 Million Social Security Numbers Stolen In Credit Check Company Attack

Information Breach Cyber Safety Ransomware E-mail Phishing Encrypted Expertise, Digital Info Protected Secured

getty

Greater than 5.6 million Individuals had their Social Safety numbers, addresses, and dates of delivery stolen when hackers infiltrated 700Credit, a Michigan-based firm that processes credit score checks for auto dealerships nationwide.

The breach, found Oct. 25, uncovered private information from credit score functions submitted to sellers between Could and October 2025, according to Wisconsin’s Department of Agriculture, Commerce and Client Safety.

Wisconsin alone counted 140,000 affected residents. Michigan reported greater than 160,000 victims in a statement from Lawyer Basic Dana Nessel. The assault labored as a result of one in every of 700Credit’s 200-plus integration companions was compromised in July however didn’t notify the corporate, according to CBT News.

Hackers exploited that breach to entry communication logs that exposed an utility programming interface used to tug client data. The API contained a design flaw: it returned information for any legitimate client ID with out verifying the requesting account had authorization.

On October 25, the attackers launched what 700Credit Managing Director Ken Hill described as a “sustained velocity assault” that continued for greater than two weeks, bombarding the uncovered API with tens of millions of automated requests. Though 700Credit shut down the compromised interface, hackers nonetheless obtained roughly 20 % of client information from the Could-to-October window.

The stolen data included full names, dwelling addresses, Social Safety numbers, and dates of delivery. The breach didn’t penetrate 700Credit’s inside community or seller techniques, Hill mentioned on a webinar hosted by ComplyAuto.

700Credit supplies credit score reviews, soft-pull prequalification instruments, id verification, and fraud detection companies to greater than 21,000 dealerships throughout automotive, RV, powersports, and marine sectors. The breach affected roughly 18,000 sellers, based on a number of business sources.

Letters are being mailed this week to affected customers. The corporate is providing between 12 and 24 months of free credit score monitoring and id theft safety. Impacted people can name 833-586-1820 for help.

Michigan Lawyer Basic Dana Nessel urged recipients to not ignore the letters. “It is crucial that anybody affected by this information breach takes steps as quickly as potential to guard their data,” Nessel mentioned. “A credit score freeze or monitoring companies can go a great distance in stopping fraud.”

700Credit says it has discovered no indication of id theft or fraud associated to the breach. The corporate notified the FBI and filed a consolidated breach discover with the Federal Commerce Fee on behalf of all affected dealerships, coordinating the response with the Nationwide Car Sellers Affiliation.

Shoppers involved about publicity ought to place a credit score freeze with the three main credit score bureaus, evaluation financial institution and bank card statements for unauthorized exercise, and look ahead to phishing makes an attempt. The assault focused finance functions, so anybody who utilized for auto financing between Could and October 2025 ought to assume their information could have been compromised.

The incident underscores vulnerabilities in third-party vendor ecosystems. Even firms with strong inside safety will be breached by way of compromised integration companions who fail to reveal their very own incidents promptly.

700Credit says it has strengthened API safety protocols, moved to a safer system infrastructure, and elevated cybersecurity insurance coverage protection. The corporate has established a devoted helpline at 866-273-0345 for seller and client questions.

Affected people ought to monitor their credit score reviews intently. Free weekly credit score reviews can be found from every of the three main bureaus by way of AnnualCreditReport.com.

700Credit didn’t present remark earlier than time of publication.