Hi, what are you looking for?
Consumer loan provider TMX Finance is informing over 4.8 million individuals that their personal information was stolen in a data breach.
By
Flipboard
Reddit
Pinterest
Whatsapp
Whatsapp
Email
Consumer loan company TMX Finance has started informing over 4.8 million individuals that their personal information was stolen in a data breach.
Operating roughly 1,100 stores in 15 states, TMX offers loans under three brands, namely TitleMax (title lending services), TitleBucks (car title loans), and InstaLoan (fast-approval personal loan services).
The data breach was identified on February 13, 2023, and impacted the customers of all services, reads the notification letter to the affected individuals, a copy of which was submitted to the Maine Attorney General’s Office.
According to TMX, the attackers accessed its systems in December 2022, but the data exfiltration only happened between February 3 and February 14, 2023.
Compromised personal information includes names, addresses, phone numbers, email addresses, birth dates, driver’s license and passport numbers, ID numbers, Social Security numbers, tax identification numbers, and/or financial account details.
The company says it has contained the incident and rotated all employee passwords, but continues to monitor its network for suspicious activity. It also informed law enforcement of the incident.
TMX informed the Maine Attorney General that more than 4.8 million individuals were impacted by the data breach.
The company did not say how the intruders gained access to its network and whether ransomware was used in the attack.
SecurityWeek has emailed TMX for additional information on the incident and will update this article as soon as a reply arrives.
Stolen personal information is often sold or shared on cybercrime websites and then used in various types of attacks, including phishing.
TMX is facing a class action lawsuit as a result of the data breach.
Related: 500k Impacted by Data Breach at Debt Buyer NCB
Related: ChatGPT Data Breach Confirmed as Security Firm Warns of Vulnerable Component Exploitation
Related: 14 Million Records Stolen in Data Breach at Latitude Financial Services
Ionut Arghire is an international correspondent for SecurityWeek.
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.
Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.
When establishing visibility and security controls across endpoints, security professionals need to understand that each endpoint bears some or all responsibility for its own security. (Torsten George)
While there are likely many different approaches, here are a few points that are important for enterprises to consider when evaluating bot solutions. (Joshua Goldfarb)
Making threat intelligence actionable requires more than automation; it also requires contextualization and prioritization. (Marc Solomon)
Many of the most successful cybercriminals are shrewd; they want good ROI, but they don’t want to have to reinvent the wheel to get it. (Derek Manky)
Compliance and ZTNA are driving encryption into every aspect of an organization’s network and enterprise and, in turn, forcing us to change how we think about protecting our environments. (Matt Wilson)
Flipboard
Reddit
Pinterest
Whatsapp
Whatsapp
Email
Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.
LastPass DevOp engineer’s home computer hacked and implanted with keylogging malware as part of a sustained cyberattack that exfiltrated corporate data from the cloud…
GoTo said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.
A group of hackers has leaked Atlassian employee records and floorplans, information that was obtained from third-party workplace platform Envoy.
Instant Checkmate and TruthFinder have disclosed data breaches affecting a total of more than 20 million users.
AT&T is notifying millions of wireless customers that their CPNI was compromised in a data breach at a third-party vendor.
OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an…
Health services company Independent Living Systems has disclosed a data breach that impacts more than 4 million individuals.
Got a confidential news tip? We want to hear from you.
Reach a large audience of enterprise cybersecurity professionals
Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.
Copyright © 2023 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.
