700Credit 2025 Data Breach

700Credit's notification letter to affected individuals explicitly states that certain records in the web application relating to its dealership clients were copied without authorization. The letter's filing with the Maine Attorney General officially confirms both that the event was a personal-data breach and that the notification scope reached 5,836,521 people. The Michigan Attorney General also published a consumer warning describing the incident and the affected data types.

BleepingComputer reviewed the official letter and statements from a company executive, reporting that the attack used an API reached through a compromised third-party integration partner. Its coverage independently corroborates the confirmed data fields, investigation timeline, and twelve months of identity-protection support. LeakData relies on findings shared by these sources and does not speculate about the attacker's identity or undisclosed technical details.

According to the company's account, an attacker entered the system of one of 700Credit's integration partners in July 2025 and discovered an API used to retrieve consumer information. The partner did not notify 700Credit of that compromise at the time. A control weakness that failed to validate a consumer reference identifier adequately against the original requester allowed the attacker to request consumer records without authorization.

After observing unusual activity on October 25, 700Credit began an investigation with external computer-forensics specialists and terminated the exposed API. A company executive publicly said the attacker obtained roughly twenty percent of consumer data collected from dealerships between May and October 2025. The incident date is based on the earliest technical activity that can be verified from public sources.

The notification materials confirm four data categories: full names, physical addresses, dates of birth, and Social security numbers. The same fields were not necessarily present for every person, because the company said the contents varied by individual.

The cited sources do not place payment-card numbers, bank-account passwords, biometric templates, or driver's-license numbers within the confirmed scope. Those categories are therefore not added. Although 700Credit provides credit-reporting and identity-verification products, every type of information used across its product catalog cannot be assumed breached; the record remains limited to the four categories explicitly named in the notice.

700Credit said its internal network was not compromised and that the event was limited to the 700Dealer.com application layer. The initial access at an integration partner makes this a third-party connection risk that expanded through an application interface. The record does not, however, treat every system of the unnamed partner or each 700Credit dealership customer as a separate breach without supporting evidence.

The company began notifying affected dealership clients on November 21 and said written notices to individuals would begin on December 22. In coordination with the National Automobile Dealers Association, it submitted a consolidated notice to the Federal Trade Commission on its own behalf and for affected dealer clients. State attorneys general and the FBI were also notified about the incident.

700Credit offered affected individuals twelve months of free credit monitoring and identity-restoration services through TransUnion. Notice recipients should enroll before the stated deadline, review their credit reports regularly, and report unfamiliar accounts or inquiries promptly. Messages that appear to come from the company but request a Social Security number or payment should be verified through an independently obtained contact channel.

Because a Social Security number is not readily replaceable, short-term monitoring alone may not address the continuing risk. U.S. consumers can place a free security freeze with all three major credit bureaus, use strong multifactor authentication on tax and government accounts, and watch for identity-theft indicators over the long term. A security freeze does not close existing accounts; it makes unauthorized new credit more difficult to open.

The affected-person or record count published by the official source represents the reported scope of the incident. It does not mean that every disclosed data category applied to every person. The rounded 5.8 million in news headlines and smaller interim totals in individual state filings are not added separately. The incident date is October 25, 2025, the verified day on which 700Credit detected suspicious activity; the third-party access beginning in July is described in the timeline without inventing an exact day.

Unverified person counts, data fields, and threat-actor claims are not treated as part of the public incident scope. The scope can be reassessed if a regulator issues a correction or the company publishes a final forensic report; the current account does not exceed what official notices and independent reporting support.