Loading story…
700Credit, a U.S.-based fintech and data services provider for auto, RV, and marine dealerships, suffered a significant data breach that exposed the personal information of at least 5.6 million people. The compromised data includes names, addresses, dates of birth, and Social Security numbers collected from dealership customers between May and October 2025. The company confirmed that the breach was limited to the application layer and did not impact its internal network or operations. In response, 700Credit has engaged cybersecurity experts, notified affected dealers and consumers, reported the incident to the FBI and FTC, and is offering credit monitoring services to those impacted.
The breach was publicly disclosed in December 2025, with regulatory notifications underway and no evidence yet of identity theft or fraud resulting from the incident. The event is part of a broader trend of large-scale data breaches affecting financial services firms, as highlighted by concurrent reporting on similar incidents at other companies. 700Credit is coordinating with state attorneys general and regulatory bodies to ensure compliance and consumer protection in the aftermath of the breach.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Michigan Attorney General Dana Nessel issued a public alert urging affected people to freeze credit, monitor accounts, and watch for phishing or identity theft following the 700Credit breach. The alert accompanied broader public disclosure of the incident.
As part of its response, 700Credit began offering 12 months of complimentary identity protection and credit monitoring through TransUnion to impacted individuals. The company said there was no evidence of identity theft or fraud at the time of disclosure.
Following discovery, 700Credit engaged forensic specialists, notified affected dealerships and consumers, and reported the incident to authorities including the FBI and FTC. The company also coordinated notifications with state attorneys general and the National Automobile Dealers Association on behalf of affected dealers.
After the breach, a threat actor identified by Outpost24 as using the alias ROOTBOY allegedly tried to extort 700Credit and then advertised a dataset of about 8.4 million records on underground forums. This was presented as monetization of the stolen 700Credit data.
700Credit discovered the incident on October 25, 2025, after the prolonged unauthorized access campaign. The company said the breach was limited to the 700Dealer.com application layer and did not impact its internal network or operations.
Between May and October 2025, threat actors used unauthorized access to 700Credit's application layer or API to steal dealership customer data, including names, addresses, dates of birth, and Social Security numbers. The activity affected data tied to thousands of dealerships and ultimately exposed information on roughly 5.6 to 5.8 million people.
In July 2025, attackers compromised a 700Credit integration partner and obtained API access or credentials later used to query consumer records. Multiple reports describe this third-party compromise as the origin of the breach.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
outpost24.com
Open sourcehackread.com
Open sourcethecyberthrone.in
Open sourcesecurityaffairs.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SoundCloud, Pornhub, and 700Credit have each confirmed significant data breaches impacting millions of users. SoundCloud reported unauthorized access to an ancillary service dashboard, affecting approximately 20% of its 140 million users—about 28 million people. The exposed data included email addresses and information already visible on public profiles, with no passwords or financial details compromised. The incident also caused temporary connectivity issues for some users, particularly those using VPNs, due to configuration changes made during the response. Pornhub notified select Premium subscribers that some user data was exposed following a breach at Mixpanel, a third-party analytics provider, but emphasized that sensitive information such as passwords, payment details, and government IDs were not affected. Pornhub had ceased using Mixpanel in 2021 and was informed of the breach by the vendor. 700Credit, a US-based provider of credit and identity verification services, suffered a third-party supply-chain attack that compromised the personal information of approximately 5.6 million individuals. The breach, which occurred between May and October 2025, involved unauthorized access to names, addresses, dates of birth, and Social Security numbers through a compromised API used by one of 700Credit's integration partners. 700Credit has since shut down the affected API, notified federal authorities, and is offering credit monitoring to victims. These incidents highlight the ongoing risks posed by third-party service providers and the importance of timely breach notification and response.
Jun 29, 2026
Prosper, a prominent peer-to-peer lending marketplace, suffered a significant data breach in September 2025, resulting in the exposure of sensitive personal information belonging to 17.6 million customers and loan applicants. The breach was detected on September 2, 2025, and was publicly disclosed by Prosper, which confirmed that unauthorized access to their systems had occurred. The compromised data includes a wide range of personally identifiable information such as names, email addresses, dates of birth, Social Security numbers, government-issued IDs, employment statuses, income levels, credit status information, physical addresses, IP addresses, and browser user agent details. Prosper stated that, despite the breach, there was no evidence that customer accounts or funds were accessed or compromised. The company’s customer-facing operations remained uninterrupted throughout the incident. Prosper has reported the breach to relevant authorities and is actively collaborating with law enforcement agencies to investigate the attack. The company is still determining the full scope of the data affected and has committed to providing free credit monitoring services to impacted individuals once the investigation clarifies the extent of the exposure. The breach was added to the Have I Been Pwned database on October 16, 2025, which helped reveal the scale of the incident, specifically the number of unique email addresses involved. Prosper has advised all users to change their passwords if they have not done so since the breach and to enable two-factor authentication for enhanced security. The company has also published a dedicated FAQ page to address customer concerns and provide ongoing updates. The attackers reportedly accessed the data through unauthorized queries on company databases that store customer and applicant information. Prosper emphasized that resolving the incident is a top priority and pledged to share additional information with customers as the investigation progresses. The breach has raised concerns about the security of financial services platforms and the protection of sensitive customer data. Security experts recommend that affected individuals monitor their credit reports and remain vigilant for signs of identity theft. The incident underscores the importance of robust cybersecurity measures and timely breach notification in the financial sector. Prosper’s response and transparency in handling the breach will be closely watched by regulators and customers alike. The breach has significant implications for the privacy and security of millions of individuals whose data was entrusted to the platform.
Jun 29, 2026
AssuranceAmerica Managing General Agency disclosed a cyber intrusion that exposed the personal and insurance-related data of up to **6,998,886 individuals** after an unauthorized third party compromised an employee account and accessed parts of the company’s internal network. The company said the malicious activity occurred on March 16, 2026, was detected on March 17, and resulted in copied data files containing names, contact details, automobile insurance policy and account information, driver and vehicle information, and claims records. For some affected people, the exposed data may also include **driver’s license numbers**, **Social Security numbers**, and **Tax ID numbers**. AssuranceAmerica said it completed its forensic review on June 15 and began notifying affected individuals in July, after initially reporting a smaller impact before later filings raised the total to nearly 7 million. In response, the insurer took affected servers offline, isolated impacted systems, disabled compromised credentials, reset passwords, expanded monitoring and threat detection, increased employee cybersecurity training, notified law enforcement, and offered two years of identity protection and credit monitoring through IDX. The company also warned customers to watch for phishing attempts and identity-related fraud.
Jul 14, 2026