Auto Dealership Data Breach 2026: 10 Dealers Filed for 17,914 People, While One Vendor’s Notice Reached 5.8 Million

As of November 5, 2026, our auto dealership data breach 2026 tracker counts 10 dealers on state attorney general lists, stating 17,914 people and a median of 1,909 per filing with a stated total. One dealer vendor outweighs them 326 to 1: 700Credit’s Texas filing states 5,836,521 people. The newest dealer row is Carvana HC LLC, Oct 5, 2026.

The six filings that print a resident count add up to 1,070,061, or 18% of the Texas total. The other 4,766,460 people sit in states where we could not read a count, so the whole radius cannot be mapped from the public records we could read. Spread evenly, 5,836,521 people across 18,000 dealers is about 324 per dealer, under the FTC’s 500-consumer line. That is only an average, and the real distribution is not public. Dealers could not tell from what they had whether they were over it: the dealer association’s alert says that gap is why NADA asked the FTC to let 700Credit file one consolidated notice for its dealer clients, and says the FTC agreed. We found no FTC statement of that arrangement, and 700Credit’s own letters say only that it notified the FTC. Indiana prints the total as 583,652, exactly one digit short of Texas, which looks like a keying error. The cause is also unsettled in public sources: Infosecurity Magazine reported a suspected misconfigured API, while the settlement agreement says compromised credentials.

Every dated filing: dealers and dealer vendors

What changed most recently: Texas published Motility’s restated total on Oct 23, 2026, a day after its New Hampshire supplement; Carvana HC LLC joined the Massachusetts report on Oct 5, 2026; before that, Pearson Ford on the Indiana list on Jul 14, 2026. Click a column to sort. Each portal date links to the state document. People are as stated: a national total where a list prints one, otherwise residents of the states shown, marked with a plus sign as a floor. A state list is not an FTC filing, and it says nothing about whether a filer met any deadline.

Portals: IN Indiana, MA Massachusetts, TX Texas, CA California, WA Washington, NH New Hampshire, VT Vermont (log starts April 17, 2026), IA Iowa. Filers we read and left out are in the CSV, including Nissan North America: its 84,828-person Texas row is an employee notice about Oracle PeopleSoft, not customer data. Top search results quote leak-site claims, such as DragonForce and Mullinax Ford; we did not use those.

Count and people by month, 2026 against 2025

One dot per filer, placed on the month of first state listing, with radius growing in proportion to the square root of people stated. The figure under each month is its total. Hollow dots: no count stated, or listed only in Texas, which has no 2025 baseline.

June 2026 is the busiest month, with 3 filers: Karl Auto Group, Ray Riding Motors and Peruzzi Buick GMC. February, March, August and September have none. Compared like for like, five portals that publish both years (California, Indiana, Massachusetts, New Hampshire, Iowa), January 1 to November 3, hold 9 dealers in 2026 against 14 in 2025, and 17,423 people against 419,848. Almost all of that drop is one filing: Fitzgerald Auto Malls’ 381,679 in April 2025. Without it, 2025 stands at 38,169. Those five portals carried 4,802 rows of all kinds in the 2026 window against 4,738 in 2025, so dealers fell from 3.0 to 1.9 per 1,000 rows.

Read the 2026 decline with care. The median dealer here lists 126 days after the breach start, so attacks from summer 2026 may not be listed yet. And 15 dealers is not 15 attacks on the sector: it is only those whose legal names give the trade away. Curry Management Corporation, which one aggregator calls Curry Automotive, shows why the count is a floor.

Vendor against dealer share of people

The answer depends on the window, so here are three. Counting events first listed since Motility’s notice of September 29, 2025, vendors hold 6,604,907 people and dealers 36,088, a vendor share of 99.5%. For all of 2025 it is 94.0%. For filings first listed in 2026 it falls to 4.4%, because the two big vendor notices began in 2025 and only two wholesale auctions (824 people stated) are new this year. Motility’s October 22, 2026 supplemental notice says routine file maintenance on September 2, 2026 found more affected files, more than a year after the August 2025 attack. Texas now shows 767,562 in total and 194,755 Texans, against the 766,000 Indiana listed in 2025, an implied rise of about 1,562 if Indiana’s round figure was exact. Motility serves RV and power sports dealers, and 700Credit’s clients also include RV, powersports and marine dealers, so these people are not all car buyers.

Two marketplace and factory events top the search results but do not fit this table. Have I Been Pwned lists CarGurus (February 2026) at 12,461,887 accounts, including dealer account data and auto finance application outcomes, yet we found no CarGurus row on the eight portals, and the count is of email addresses, not notified people. The reported January 2026 Nissan and Infiniti dealer vendor incident, which a vendor blog covers along with Nissan’s statement that its own systems were not affected, also has no portal row under any name we could tie to it.

Time to notice: three dates, three different clocks

5 of the 10 dealers give a date of awareness in a filing or field. The median gap to first state listing is 59 days and 4 exceed 30, led by Clawson Honda at 328 days and D’Ambrosio Dodge at 162. The 2025 dealers with a date ran longer, a median of 184 across 6, but that comparison is censored: a 2026 attack with a 400-day review cannot appear yet. Vendors with a date ran 41, 48, 71 days, median 48. From breach start, the 2026 median is 126 days across 8 dealers, against 192 across 7 in 2025.

None of this measures FTC compliance. A state listing is a different filing, under different statutes, and “aware” in a consumer letter may not match “discovery” under 16 CFR 314.4(j)(2). The letters do show where the time goes. D’Ambrosio’s forensic work identified files on January 21, 2026 and the file review ended March 16. Clawson’s letter calls its review time-intensive. Fitzgerald’s counsel described months of importing and reviewing data, and its notice came 446 days after a February 2024 ransomware event. Clawson and Peruzzi list the same breach start, February 27, 2025; neither names a shared vendor, and we draw no link.

Only one 2026 dealer filing we could read states an FTC report: Karl Auto Group’s Iowa notice says the incident went to the FTC “as the Company is a motor vehicle dealer (financial institution) subject to the Safeguards Rule.” The nine other dealer letters we could machine-read mention the FTC at most as a consumer resource. Silence is not evidence of non-filing, because the FTC publishes no list that we could find. 7 of the 10 state 500 or more people, though those counts can include staff, who are not “customers” under the rule. The state-level timing picture for all sectors is in our study of how long companies take to report data breaches.

CDK Global, June 2024: what is filed and what is not

CDK is the outage every dealer IT conversation returns to, and it belongs here as context, because it is an availability event with almost no consumer-notice trail. CDK Global, Inc. filed Form 15-12G on July 18, 2022 when it went private, so it files no 8-K. Its owner, Brookfield Business Partners (NYSE: BBU), is listed and did mention the incident. Public dealer groups carry the rest of the record.

What is not on file. No filing we read states how many people’s data CDK held at risk, whether data left, or any payment. The only CDK row on the state lists we checked is “CDK Global LLC” on Massachusetts’ 2024 report, reported September 23, 2024, one resident, and nothing ties it to June. California, Indiana and Washington show no CDK row since June 2024; Texas’s list does not reach back that far, and Maine’s database is offline. Privately held dealers disclosed nothing that we can see. For 2026 the pattern is quiet too: a search of 8-Ks from 19 listed auto retailers, marketplaces, auctions and lenders, October 2025 to November 5, 2026, returned 62 hits on three cyber phrases and none under Item 1.05. Our Item 1.05 tracker and 2026 attack ledger cover filers in every sector.

A dealership’s legal duties

The full rule, its form and its enforcement history are in our FTC Safeguards Rule breach notification report. These are the points that decide a dealer’s position, drawn from 16 CFR Part 314 and the FTC’s June 2025 dealer FAQ, which is staff guidance and not binding on the Commission.

The FTC’s dealer record is short but relevant to vendors. It charged DMS maker DealerBuilt in 2019 over a hack reaching data on about 12.5 million consumers. An FTC paperwork notice says it received about 163 breach notices of all kinds in 2025 (91 FR 54872), so how many came from dealers is unknown.

FTC CARS Rule status. It no longer exists. The rule covered sales misrepresentations, price disclosure and add-ons, not data security. The Fifth Circuit vacated it on January 27, 2025 in No. 24-60013, and the FTC formally withdrew it effective February 12, 2026 (91 FR 6507). A dealer’s data duties rest on the Safeguards Rule, the Privacy Rule and state law.

What this means for MSPs

An MSP with access to a dealer’s customer data is a service provider under 314.2, and may also be the dealer’s “other agent” for the clock in 314.4(j)(2). Same-day escalation should be in the contract. For a dealer group, the useful deliverables are specific.

Frequently asked questions

Which auto dealerships reported a data breach in 2026?

As of November 5, 2026, our rule finds 10 on state attorney general lists: Lakeside Chevrolet, Clawson Honda of Fresno, Mullinax Ford of Central Florida, D’Ambrosio Dodge, LoneStar Truck Group / TAG Truck Center, Karl Auto Group, Ray Riding Motors, Peruzzi Buick GMC, Pearson Ford and Carvana HC LLC. Together they state 17,914 people, and Peruzzi Buick GMC is the largest at 5,450. Name-silent dealers are not counted.

What company just had a data breach recently?

In the dealer lane, the newest first listing is Carvana HC LLC, on Oct 5, 2026. In the vendor lane, Texas published Motility Software Solutions on Oct 23, 2026 after a supplemental notice about the August 2025 incident. Nearest to the sector, Mavis Tire Supply appears on the Texas list on Nov 3, 2026 with 71,774 people; it is a tire retailer, so it is not counted here.

How much compensation will I get for a data breach?

A notice itself pays no cash, so any money comes from a settlement. In the 700Credit settlement the agreement sets up to $2,500 for documented losses or an estimated $50 in alternate cash, plus two years of credit monitoring. The $17.5 million fund works out to about $3.00 per person before fees of up to one-third. Claim Depot reports a September 22, 2026 claim deadline.

How do I check if I got data breached?

Start with the mail: the filings here describe written letters to affected people. Then search the Texas AG list or the Indiana and Massachusetts reports for the dealer’s name; they name firms, not people. For email exposure, Have I Been Pwned lists CarGurus at 12,461,887 accounts. If a letter names 700Credit, the sender may be a firm you never heard of acting for your dealer.

Do auto dealers have to report a breach to the FTC?

Dealers that finance, arrange financing or lease for over 90 days do, when unencrypted customer information of at least 500 consumers is acquired without authorization, within 30 days of discovery under 16 CFR 314.4(j). The under-5,000-consumer exemption in 314.6 does not remove this. Of the 10 dealers here, Karl Auto Group’s Iowa filing states that it reported to the FTC.

How do you know if a car dealership is scamming you?

The FTC’s guide says dealers must display a Buyers Guide in every used car, and warns that add-ons such as gap insurance or VIN etching can be slipped into a deal without your knowledge. The federal CARS Rule that would have policed add-ons was vacated in January 2025 and withdrawn in February 2026, so read the contract line by line and get promises in writing.

Methodology

References

1. Indiana Attorney General, Data Breach Year-to-Date Report, November 2026. Accessed November 2026.
2. Indiana Attorney General, Data Breach Year-to-Date Report 2025. Accessed November 2026.
3. Massachusetts OCABR, 2026 Data Breach Notification Report. Accessed November 2026.
4. Massachusetts OCABR, 2025 Data Breach Notification Report. Accessed November 2026.
5. Massachusetts OCABR, 2024 Data Breach Notification Report. Accessed November 2026.
6. Texas Attorney General, Data Security Breach Reports. Accessed November 2026.
7. California Attorney General, Data Security Breach Reports. Accessed November 2026.
8. Washington Attorney General, Data Breach Notifications. Accessed November 2026.
9. New Hampshire DOJ, Security Breach Notifications. Accessed November 2026.
10. Vermont Attorney General, Security Breach Notices. Accessed November 2026.
11. Iowa Attorney General, Security Breach Notifications. Accessed November 2026.
12. Maine Attorney General, Data Security Breaches (database offline notice). Accessed November 2026.
13. 700Credit, notice to the Iowa Attorney General, December 12, 2025. Accessed November 2026.
14. 700Credit, notice to the New Hampshire Attorney General, December 12, 2025. Accessed November 2026.
15. Motility Software Solutions, supplemental notice to New Hampshire, October 22, 2026. Accessed November 2026.
16. Karl Auto Group, notice to the Iowa Attorney General, June 2, 2026. Accessed November 2026.
17. In re 700 Credit Data Security Litigation, No. 25-cv-13747 (E.D. Mich.), settlement agreement, ECF 49-2, filed June 3, 2026 (copy hosted by ClassAction.org). Accessed November 2026.
18. eCFR, 16 CFR Part 314. Accessed November 2026.
19. FTC, Automobile Dealers and the FTC’s Safeguards Rule: FAQs. Accessed November 2026.
20. FTC, Safeguards Rule Security Event Reporting Form. Accessed November 2026.
21. FTC, 91 FR 54872 (Aug. 25, 2026). Accessed November 2026.
22. FTC, LightYear Dealer Technologies (DealerBuilt), 84 FR 28054 (June 17, 2019). Accessed November 2026.
23. National Automobile Dealers Association v. FTC, No. 24-60013 (5th Cir. Jan. 27, 2025). Accessed November 2026.
24. FTC, Withdrawal of the CARS Rule, 91 FR 6507 (Feb. 12, 2026). Accessed November 2026.
25. FTC, Buying a Used Car From a Dealer. Accessed November 2026.
26. Sonic Automotive, Form 8-K/A, Item 1.05, August 5, 2024; Q2 2024 results; 2025 Form 10-K. Accessed November 2026.
27. AutoNation, Q2 2024 Form 10-Q. Accessed November 2026.
28. Asbury Automotive, Q2 2024 results; Form 10-Q. Accessed November 2026.
29. Group 1 Automotive, Q2 2024 Form 10-Q. Accessed November 2026.
30. Lithia Motors, Q2 2024 Form 10-Q. Accessed November 2026.
31. Have I Been Pwned, CarGurus breach record. Accessed November 2026.
32. Minnesota Automobile Dealers Association, 700Credit Data Breach (Dec. 4, 2025), trade source for the dealer count and consolidated notice. Accessed November 2026.
33. Claim Depot, 700Credit settlement page, aggregator source for the claim deadline and approval date. Accessed November 2026.