A major data breach at credit verification firm 700Credit has exposed the personal information of more than 5.8 million individuals, with the company blaming a third-party API vulnerability.
Quick Summary – TLDR:
- Over 5.8 million individuals had sensitive data stolen in a breach at 700Credit.
- The incident was traced to a compromised third-party partner API.
- Data stolen includes names, addresses, birth dates, and Social Security numbers.
- Affected individuals will receive credit monitoring and identity restoration support.
What Happened?
Credit check and identity verification provider 700Credit, which services over 18,000 dealerships across the U.S., has confirmed a massive data breach impacting at least 5.8 million people. The company says attackers exploited a third-party API vulnerability to access sensitive consumer data collected between May and October 2025. The breach went undetected until October 25, and official notifications to affected individuals began rolling out in late November.
At least 5.6 million people had their names, addresses, dates of birth, and Social Security numbers stolen in a data breach at 700Credit, a company that runs credit checks and identity verification services for auto dealerships across the United States.https://t.co/9W3wmEcFlW
— ExposeIT⚡️ (@RealWaKhan) December 14, 2025
Third-Party Access Exposes Sensitive Data
700Credit, based in Michigan, specializes in credit reporting and identity verification services for auto, marine, RV, and powersports dealers across North America. The company revealed that hackers gained entry through a compromised integrated partner system in July 2025. Using the partner’s credentials, the attackers accessed the 700Dealer.com web application layer and copied records without authorization.
The stolen data includes:
- Full names
- Home addresses
- Dates of birth
- Social Security numbers
While the internal network of 700Credit was not breached, the company acknowledged that data from its dealership clients was taken during the attack.
Delay in Detection and Notifications
The breach was not discovered until October 25, despite malicious activity starting months earlier. According to a notification filed with the Maine Attorney General’s Office, exactly 5,836,521 individuals were impacted. The company began alerting dealerships on November 21, with written notifications to affected consumers scheduled to begin December 22.
700Credit has partnered with the National Automobile Dealers Association (NADA) to file a consolidated report with the Federal Trade Commission (FTC). The company has also informed attorney general offices across the United States and reported the incident to the FBI.
Response and Measures Taken
In response, 700Credit has:
- Upgraded its API validation protocols.
- Switched to a more secure integration system.
- Enhanced cybersecurity insurance coverage.
Impacted individuals are being offered 12 months of free credit monitoring and identity restoration services. Despite the scale of the breach, the company insists that there is currently no evidence of fraud or identity theft directly linked to the incident.
Official Warnings and Consumer Advice
Michigan Attorney General Dana Nessel emphasized the importance of immediate action. Nessel warned:
Consumers are being urged to:
- Update passwords for email and financial accounts.
- Watch for phishing emails, suspicious texts, and scam calls.
- Consider using identity theft protection services.
- Be cautious of unsolicited links and downloads.
SQ Magazine’s Takeaway
I find this breach especially alarming because it exposes how fragile our digital security still is, even with trusted companies. Millions of people had their most sensitive data compromised, not directly through 700Credit, but through a partner they trusted. If you’ve ever applied for a car loan, there’s a chance your info passed through this system. Don’t brush this off. Take it seriously, check if you’re affected, and use the tools offered. Cybercrime is real, and it’s becoming smarter every day.
