Data leak
700Credit Automotive Credit Verification Data Breach - 5.8M Vehicle Dealer Customers
Primary Source βIncident Details
700Credit β the largest provider of credit reporting, identity verification, fraud and compliance services for US automotive dealerships β suffered a data breach between approximately May and October 2025. Attackers compromised a partner’s API access in July 2025, enabling unauthorized access to consumer data collected through the 700Credit platform. The breach was identified on October 25, 2025. 700Credit began notifying approximately 18,000 affected dealership clients on November 21, 2025, and started sending written notifications to 5.8 million affected consumers on December 22, 2025. Compromised data includes names, addresses, dates of birth, and Social Security numbers β reportedly stored in unencrypted format. The scale of unencrypted SSN exposure across such a large automotive credit ecosystem resulted in multiple class action investigations. 700Credit serves the credit-check and identity verification needs of automotive dealerships across the United States.
Technical Details
- Initial Attack Vector
- Attackers compromised a partner's system in July 2025 and gained unauthorized access to a third-party API linked to 700Credit's web application, likely via web application vulnerability or misconfiguration
Timeline
- 2025-07-01 Breach occurred
- 2025-11-21 Publicly disclosed
- 2025-12-22 Customers notified