Image Credit: CSO Online
The publicly traded financial services company TMX Finance has reported a data breach incident that resulted in the exposure of personally identifiable information (PII) on nearly five million customers.
Three of TMX Finance’s subsidiaries—TitleMax, TitleBucks, and InstaLoan—have all experienced difficulties. InstaLoan is a personal loan service for those with bad credit, TitleMax is a lending company, TitleBucks offers car loans, and TitleMax is a lending company.
The attacker made off with full customer names, birth dates, passport numbers, driver’s license numbers, federal/state identification card numbers, tax identification numbers, social security numbers, financial account information, phone numbers, postal addresses, and email addresses, according to TMX Finance, which sent out a notification to those who were impacted.
In February, data was stolen.
4,822,580 customers had been affected in total by the hack.
Although TMX claimed in the statement that the breach happened in early December 2022, it wasn’t until February 13 of 2023 that management became aware of a problem. After two weeks of investigation, the business announced on March 1 that the data theft occurred between February 3 and February 14 after concluding its investigation.
Image Credit: PNCB
The business reset all employee accounts and added more endpoint monitoring and protection measures to address the problem. Also, Experian provided free identity protection for 12 months to all affected people.
A Canadian company called TMX Finance runs more than 900 locations in more than fourteen US states.
There is no information available about potential attackers.
According to the company’s notice, “On February 13, 2023, we discovered unusual activity on our networks and swiftly took action to investigate the situation. “According to the current investigation, the earliest known compromise of TMX’s systems began in early December 2022.”
Read More: Apple is currently pushing out its “buy now, pay later” service to a restricted group of people.
The inquiry concluded on March 1, 2023, that the data might have been obtained between February 3, 2023, and February 14, 2023.
