Consumer loan company TMX Finance has started informing over 4.8 million individuals that their personal information was stolen in a data breach.
Operating roughly 1,100 stores in 15 states, TMX offers loans under three brands, namely TitleMax (title lending services), TitleBucks (car title loans), and InstaLoan (fast-approval personal loan services).
The data breach was identified on February 13, 2023, and impacted the customers of all services, reads the notification letter to the affected individuals, a copy of which was submitted to the Maine Attorney General’s Office.
According to TMX, the attackers accessed its systems in December 2022, but the data exfiltration only happened between February 3 and February 14, 2023.
Compromised personal information includes names, addresses, phone numbers, email addresses, birth dates, driver’s license and passport numbers, ID numbers, Social Security numbers, tax identification numbers, and/or financial account details.
The company says it has contained the incident and rotated all employee passwords, but continues to monitor its network for suspicious activity. It also informed law enforcement of the incident.
TMX informed the Maine Attorney General that more than 4.8 million individuals were impacted by the data breach.
The company did not say how the intruders gained access to its network and whether ransomware was used in the attack.
SecurityWeek has emailed TMX for additional information on the incident and will update this article as soon as a reply arrives.
Stolen personal information is often sold or shared on cybercrime websites and then used in various types of attacks, including phishing.
TMX is facing a class action lawsuit as a result of the data breach.
Related: 500k Impacted by Data Breach at Debt Buyer NCB
Related: ChatGPT Data Breach Confirmed as Security Firm Warns of Vulnerable Component Exploitation
Related: 14 Million Records Stolen in Data Breach at Latitude Financial Services
More from Ionut Arghire
- Toyota Discloses New Data Breach Involving Vehicle, Customer Information
- Adobe Inviting Researchers to Private Bug Bounty Program
- Critical Vulnerabilities Found in Faronics Education Software
- Chrome 114 Released With 18 Security Fixes
- Spyware Found in Google Play Apps With Over 420 Million Downloads
- Millions of WordPress Sites Patched Against Critical Jetpack Vulnerability
- PyPI Enforcing 2FA for All Project Maintainers to Boost Security
- Personal Information of 9 Million Individuals Stolen in MCNA Ransomware Attack
Latest News
- Russia Blames US Intelligence for iOS Zero-Click Attacks
- Toyota Discloses New Data Breach Involving Vehicle, Customer Information
- Cisco Acquiring Armorblox for Predictive and Generative AI Technology
- Moxa Patches MXsecurity Vulnerabilities That Could Be Exploited in OT Attacks
- Amazon Settles Ring Customer Spying Complaint
- Organizations Warned of Salesforce ‘Ghost Sites’ Exposing Sensitive Information
- Adobe Inviting Researchers to Private Bug Bounty Program
- Critical Vulnerabilities Found in Faronics Education Software
