Free tools Windows power users keep installed
One-click scans. No signup required.
Advance Auto Parts disclosed unauthorized activity in a third-party cloud database on May 23, 2024. The company said some affected files may have contained Social Security numbers or other government identification numbers belonging to current and former employees and job applicants. It planned to record approximately $3 million in initial incident-response and remediation expense for the quarter ending July 13, 2024—an early estimate, not a final bill.
The company reported no material interruption to operations. Its filing did not establish that all customer records, payment-card data or vehicle-purchase histories were stolen. Advance Auto Parts said it expected to notify affected people and offer credit-monitoring and identity-restoration services where appropriate.
What happened
Advance Auto Parts identified unauthorized activity in a third-party cloud database environment on May 23, 2024. On June 4, the company learned that a criminal threat actor was offering alleged company data for sale and notified law enforcement. Advance Auto Parts disclosed the incident in a Form 8-K filed June 14, 2024.
The filing described unauthorized activity and a data-sale claim; it did not call the event ransomware. The company also said the incident had not materially interrupted business operations. The primary disclosure is available in the SEC Form 8-K.
#1 Best Overall
Timeline
| Date | Event |
|---|---|
| May 23, 2024 | Advance Auto Parts identified unauthorized activity in a third-party cloud database. |
| June 4, 2024 | The company learned that a threat actor was offering alleged company data for sale and contacted law enforcement. |
| June 14, 2024 | Advance Auto Parts filed its Form 8-K disclosure with the Securities and Exchange Commission. |
| February 5, 2026 | The official settlement website said payments had been issued to approved claimants. |
The filing date and accession details are listed in the SEC filing index.
What information may have been exposed?
Advance Auto Parts said some files it believed were affected appeared to contain personal information for current and former employees and job applicants. The categories it identified were:
- Social Security numbers;
- Other government identification numbers; and
- Related personal information held in employee or applicant files.
The filing did not confirm that every employee record was involved, nor did it confirm exposure of customer payment-card numbers, passwords, vehicle-purchase histories or all customer accounts. A retail customer should not assume inclusion solely because they bought a part or created an online account.
What the “millions” cost figure means
Advance Auto Parts expected to record approximately $3 million in incident-response and remediation expense for the quarter ending July 13, 2024. The company described that estimate as preliminary and subject to change as its investigation continued.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRank #3
| Question | What the cited filing establishes |
|---|---|
| Initial accounting estimate | Approximately $3 million in planned response and remediation expense for the specified quarter. |
| Final amount paid by the company | Not established by the initial filing. |
| Possible additional exposure | Could include notification, legal fees, monitoring, remediation, regulatory matters, litigation, settlements and other downstream costs. |
| Insurance | The company had cyber-incident insurance and expected covered costs above its policy retention to be reimbursed. |
Insurance reimbursement is not a promise that every lawsuit, settlement, penalty or business loss will be covered. The $3 million should therefore be read as an initial quarterly expense estimate, not the breach’s definitive total liability.
How large was the stolen dataset?
Cybernews reported that a malicious actor claimed to possess roughly three terabytes of Advance Auto Parts data and that a reviewed sample appeared legitimate. That volume was the attacker’s claim as reported by the publication, not a confirmed measurement in Advance Auto Parts’s SEC filing. The company’s own disclosure used cautious terms such as “some files,” “may” and “believes.”
Accordingly, the confirmed facts are the unauthorized activity, the alleged sale offer and the possible presence of employee and applicant identifiers—not a verified three-terabyte theft or universal exposure of customer data. Cybernews’ account is at cybernews.com.
Who is most likely to be affected?
People with the strongest connection to the sensitive information described in the filing are:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Best Value
- Current Advance Auto Parts employees;
- Former employees;
- Current or former job applicants; and
- Anyone who receives a formal breach notice from Advance Stores Company, Incorporated or an authorized administrator.
Customers should rely on an official notice rather than assume that shopping history or an online account made them part of the affected population.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do if you may be affected
- Verify the notice. Use contact details in a letter or on an official Advance Auto Parts or settlement website. Do not use unsolicited links or phone numbers supplied in suspicious messages.
- Activate free assistance. If Advance Auto Parts offers credit monitoring or identity-restoration services to you, enroll through the instructions in the notice. A settlement benefit may have separate eligibility and deadlines.
- Consider a credit freeze. If your Social Security number or government identification number was exposed, a freeze can block most new-credit inquiries until you lift it. A fraud alert is a lighter alternative that asks creditors to verify your identity.
- Review reports and accounts. Check your credit reports and watch bank, card, tax, employment, insurance and benefits accounts for unfamiliar activity.
- Secure online accounts. Change passwords reused elsewhere and turn on multifactor authentication. A password manager can help prevent account takeover, but it cannot replace an exposed government identifier.
- Keep records. Save the breach letter, monitoring enrollment details and receipts or other documentation for any identity-theft losses.
Exposure increases the risk of identity theft and fraud; it does not prove that identity theft occurred. Report suspected misuse through the appropriate government or financial-institution channels.
Lawsuits and settlement status
Class-action complaints filed after the disclosure allege that Advance Auto Parts failed to use adequate safeguards and seek relief for people whose information was compromised. Allegations in a complaint are claims by plaintiffs, not judicial findings. The complaints are available as McGee v. Advance Auto Parts and Dragone v. Advance Auto Parts.
As of February 5, 2026, the official settlement website said approved claims had been paid. That update does not mean every person affected received money. Eligibility depended on the settlement’s class definition, claim process, deadlines and any requirements for documented losses or particular subclasses. Settlement payments are also separate from the company’s original $3 million accounting estimate.
What remains unknown
- The final number of individuals whose information was involved;
- The complete set of data actually taken or offered for sale;
- Whether customer records were included;
- The final gross and net cost after insurance and later expenses;
- Any eventual regulatory penalties; and
- Whether all data in the attacker’s claimed collection was authentic.
Bottom line
Advance Auto Parts confirmed a 2024 intrusion involving a third-party cloud database and warned that employee and job-applicant files may have contained sensitive government identifiers. Its approximately $3 million figure was a preliminary response-and-remediation estimate for one quarter, with insurance expected to cover covered costs above the policy retention. The filing did not establish that all customers were affected or that the attacker’s claimed data volume was accurate. Former and current workers and applicants should watch for an official notice, use any offered free protections and consider a credit freeze when highly sensitive identifiers were involved.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
