TMX Finance discloses breach affecting 4.8 million TitleMax and InstaLoan customers

TMX Finance, the Savannah, Georgia consumer lender behind the TitleMax, TitleBucks and InstaLoan brands, disclosed a data breach affecting 4,822,580 customers. The company filed a notification with the Office of the Maine Attorney General and began notifying state regulators around 30 March 2023.

According to that filing, the intrusion began in early December 2022 but went undetected until 13 February 2023, when TMX identified suspicious activity on its systems. An investigation completed on 1 March 2023 concluded that customer information had been acquired between 3 and 14 February.

The exposed fields were extensive. They included full names, dates of birth, passport numbers, driver's licence numbers, federal and state identification card numbers, tax identification numbers, Social Security numbers, financial account information, telephone numbers, physical addresses and email addresses.

TMX operates roughly 1,000 storefronts across the United States offering car title and personal loans, largely to borrowers with weak credit. In response to the breach the company reset employee passwords, deployed additional endpoint protection, reported the incident to the FBI and offered affected customers 12 months of credit monitoring and identity protection through Experian IdentityWorks. It said it was continuing to monitor its systems for suspicious activity.