More than 5.6 million Americans had their Social Security numbers, addresses, and dates of birth stolen when hackers infiltrated 700Credit, a Michigan-based company that processes credit checks for auto dealerships nationwide.
The breach, discovered Oct. 25, exposed personal data from credit applications submitted to dealers between May and October 2025, according to Wisconsin’s Department of Agriculture, Trade and Consumer Protection.
Wisconsin alone counted 140,000 affected residents. Michigan reported more than 160,000 victims in a statement from Attorney General Dana Nessel. The attack worked because one of 700Credit’s 200-plus integration partners was compromised in July but did not notify the company, according to CBT News.
Hackers exploited that breach to access communication logs that revealed an application programming interface used to pull consumer information. The API contained a design flaw: it returned data for any valid consumer ID without verifying the requesting account had authorization.
On October 25, the attackers launched what 700Credit Managing Director Ken Hill described as a “sustained velocity attack” that continued for more than two weeks, bombarding the exposed API with millions of automated requests. Although 700Credit shut down the compromised interface, hackers still obtained roughly 20 percent of consumer data from the May-to-October window.
The stolen information included full names, home addresses, Social Security numbers, and dates of birth. The breach did not penetrate 700Credit’s internal network or dealer systems, Hill said on a webinar hosted by ComplyAuto.
700Credit provides credit reports, soft-pull prequalification tools, identity verification, and fraud detection services to more than 21,000 dealerships across automotive, RV, powersports, and marine sectors. The breach affected approximately 18,000 dealers, according to multiple industry sources.
Letters are being mailed this week to affected consumers. The company is offering between 12 and 24 months of free credit monitoring and identity theft protection. Impacted individuals can call 833-586-1820 for assistance.
Michigan Attorney General Dana Nessel urged recipients not to ignore the letters. “It is important that anyone affected by this data breach takes steps as soon as possible to protect their information,” Nessel said. “A credit freeze or monitoring services can go a long way in preventing fraud.”
700Credit says it has found no indication of identity theft or fraud related to the breach. The company notified the FBI and filed a consolidated breach notice with the Federal Trade Commission on behalf of all affected dealerships, coordinating the response with the National Automobile Dealers Association.
Consumers concerned about exposure should place a credit freeze with the three major credit bureaus, review bank and credit card statements for unauthorized activity, and watch for phishing attempts. The attack targeted finance applications, so anyone who applied for auto financing between May and October 2025 should assume their data may have been compromised.
The incident underscores vulnerabilities in third-party vendor ecosystems. Even companies with robust internal security can be breached through compromised integration partners who fail to disclose their own incidents promptly.
700Credit says it has strengthened API security protocols, moved to a more secure system infrastructure, and increased cybersecurity insurance coverage. The company has established a dedicated helpline at 866-273-0345 for dealer and consumer questions.
Affected individuals should monitor their credit reports closely. Free weekly credit reports are available from each of the three major bureaus through AnnualCreditReport.com.
700Credit did not provide comment before time of publication.