Short answer: The breach involved 700Credit LLC, a Michigan company that provides credit-reporting and identity-verification services to auto dealerships. A Maine regulatory filing identified 5,836,521 affected people. The official breach notices reviewed identify names, addresses, dates of birth and Social Security numbers—not confirmed payment-card numbers, expiration dates or CVV codes.
If you applied for vehicle financing, bought or leased a vehicle, or underwent a dealership credit check between May and October 2025, read any notice carefully and consider freezing your credit with Equifax, Experian and TransUnion.
What happened in the 700Credit breach?
700Credit supplies dealerships with services used during vehicle-financing and credit-application processes. It is not a bank or credit-card issuer, so many affected consumers may not recognize the company even though their information passed through its systems.
According to the company’s consumer notice, investigators determined that unauthorized parties copied certain records from a 700Credit web application. Public reporting and litigation documents describe possible access through a compromised integration, API or credentials, but the available public notices do not provide a complete forensic account. Those technical explanations should therefore be treated as attributed accounts, not a final independently established cause.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The Maine attorney general filing lists 5,836,521 people. Other reports round the figure to 5.6 million, 5.8 million or nearly 6 million. Approximately 18,000 dealerships were reportedly connected to the affected dataset.
Read the Maine filing and the Michigan attorney general’s consumer alert.
Were credit-card details leaked?
That claim is not established by the official breach notices reviewed. Despite headlines describing leaked credit-card details, the official notices identify exposed personal information—not payment-card numbers—as the principal data involved.
The California notice lists the following information:
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Names or other personal identifiers
- Addresses
- Dates of birth
- Social Security numbers
The notice does not say that full card numbers, expiration dates or CVV security codes were accessed. TechRadar also reported that 700Credit’s login and payment information were not compromised, but that is a company or media-reported statement rather than a substitute for a complete public forensic report.
Do not assume every person had every listed field exposed. Your individual notification should state which information was associated with you. The California breach notice is the clearest public source for the documented data categories.
700Credit breach timeline
| Date | What it represents |
|---|---|
| May–October 2025 | Period during which affected consumer information was collected through dealership activity. |
| October 25–27, 2025 | Incident window listed in the Maine filing. |
| October 25, 2025 | Date the consumer notice says 700Credit became aware of suspicious activity. |
| November 21, 2025 | Discovery date listed in the Maine filing. |
| December 2025 | Consumer notifications began being mailed in multiple states. |
| June 2026 | A court notice reported a $17.5 million settlement in litigation concerning the incident. |
The dates are not interchangeable: an incident window, the date a company becomes aware of suspicious activity and the date an investigation confirms unauthorized access can differ.
Who may be affected?
You may be included if you:
- Applied for vehicle financing through a participating dealership.
- Submitted information for a dealership credit check or financing decision.
- Bought or leased a vehicle through a dealership using 700Credit-related services.
- Had your information collected between May and October 2025.
Not recognizing 700Credit does not establish that you are unaffected. Dealerships may have used the company behind the scenes.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How will affected consumers be notified?
700Credit and affected dealership clients began mailing written notification letters in December 2025. The Michigan attorney general said letters were expected to begin going out during the week of December 15.
Check the letter for the exact data involved, the identity-monitoring provider, enrollment instructions and the deadline. Benefits vary by jurisdiction and individual notice. TechRadar reported two years of free monitoring, while the Maine filing describes 12 months of TransUnion credit monitoring and identity-restoration services for Maine residents.
Be alert for follow-up phishing. A scammer may know accurate details such as your name, address or date of birth.
- Do not give an unsolicited caller your SSN, password or payment information.
- Verify contact details independently rather than relying only on an unexpected email or call.
- Use the phone number or website printed in a genuine official letter.
- Do not pay to activate monitoring described as free.
- Do not upload your full SSN, card number or identity document to an unknown breach-checking site.
What to do if you may be affected
1. Freeze your credit
A credit freeze is free and helps block most new-credit applications until you temporarily lift or remove it. You must place the freeze separately with each bureau:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A freeze is generally more useful for preventing new-credit fraud than monitoring alone, but it does not stop takeover of an existing bank, email or credit-card account.
2. Check your credit reports
Review reports for unfamiliar accounts, hard inquiries, addresses and collection activity. Use AnnualCreditReport.com, the federally authorized site, rather than an unfamiliar third-party service.
3. Add alerts and monitor existing accounts
Turn on bank, card and credit alerts. Contact a lender or financial institution directly if you see suspicious activity. Credit monitoring may not promptly detect unauthorized bank transfers, existing-account fraud, tax fraud, benefits fraud or email-account takeover.
4. Secure accounts that could be used for impersonation
Change passwords reused across email, banking and financial accounts. Enable multifactor authentication, starting with your email account because control of email can enable password resets elsewhere.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
5. Report identity theft if it occurs
If someone opens an account or otherwise misuses your identity, use IdentityTheft.gov for recovery guidance and documentation. Keep copies of the breach letter and records of calls, disputes, letters and transactions. The Michigan attorney general also recommends reviewing reports, contacting financial institutions and considering a police or FTC identity-theft report when appropriate.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Credit freeze versus fraud alert
| Protection | What it does | Trade-off |
|---|---|---|
| Credit freeze | Restricts access to your credit file for most new-credit applications. | Must be managed separately with all three bureaus when you apply for credit. |
| Fraud alert | Asks potential creditors to take additional steps to verify your identity. | Less restrictive than a freeze and does not block applications in the same way. |
A fraud alert can be useful, but an exposed SSN makes a freeze the stronger preventive option for many consumers. Neither protection replaces monitoring of existing financial accounts.
Do you need to replace your credit card?
Not automatically. If your official notice identifies SSNs and personal information but not payment-card data, replacing a card solely because of the 700Credit breach may not be necessary.
Lock or replace a card if unauthorized transactions appear, your issuer says the card was involved in another incident, the card was used at a compromised merchant, or you gave card details to someone responding to a breach-themed scam. Contact the issuer through its official app, website or the number on the card.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat protection and settlement benefits are available?
Eligible consumers were offered identity-protection or credit-monitoring assistance, but the duration and services differ by state. Follow your own letter for the provider, enrollment deadline and benefit period. Do not assume that every recipient receives the same two-year offer.
A court notice filed in June 2026 reported a $17.5 million settlement in litigation concerning the 700Credit incident. The notice describes allegations and says the settlement is not an admission of wrongdoing. It should not be read as a promise that every affected person will receive cash, nor should you assume that filing a settlement claim is required to receive monitoring benefits. Check the current court-authorized notice for operative deadlines, claim categories and instructions.
View the court settlement notice.
What remains uncertain?
- Whether any payment-card information was accessed; the official notices reviewed do not establish that it was.
- The final technical explanation for how unauthorized access occurred.
- Whether exposed information has been publicly traded or used in confirmed fraud.
- The precise monitoring and restoration benefits available to each affected person.
700Credit said its notice found no evidence of identity theft or fraud resulting from the incident at the time of notification. That means no evidence had been identified then; it is not proof that no later misuse can occur.
Quick Recap
Sources
- California Attorney General: 700Credit Notice of Data Event
- Maine Attorney General breach filing
- Michigan Attorney General consumer alert
- TechRadar report
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
