Internal documents and insider communications obtained by CDG News reveal that 700Credit, one of the auto industry's largest credit reporting and identity verification providers, experienced a data breach on or around October 25, 2025. Driving the news: Consumer names, addresses, and Social Security numbers from auto financing applications submitted between May and October 2025 were compromised, according to a letter sent to its dealer partners. For context: 700Credit discovered the breach after being "alerted to suspicious activity within our proprietary web-based application 700Dealer.com." The company then brought in third-party forensic specialists to investigate, and determined that customer data had been copied from the application without authorization. 700Credit elaborated that its internal network remains unaffected. How we got here: Dark web monitoring service databreach.io first flagged the breach in mid-November after spotting threat actors trying to sell stolen data online. The listing claimed the database contained over 8 million records and that negotiations between attackers and the company had broken down. Although managing director, Ken Hill, told Automotive News that only 5.6 million records were impacted. Zooming out: A class action lawsuit has already landed. Patricia Young v. 700 Credit, LLC was filed November 24 in U.S. District Court for the Eastern District of Michigan, alleging “negligent security practices” led to the breach. ❝ Why it matte

700Credit, a credit check and compliance provider, suffered a significant data breach in late October, affecting nearly 18,000 dealerships and more than 5.6 million customers. On today’s episode of Inside Automotive, 700Credit Managing Director Ken Hill discusses what happened and how the company is responding. 700Credit communicates with over 200 integration partners through APIs. One of those partners was compromised in July, but the company did not notify 700Credit. Hackers took over that partner’s system and gained access to communications logs, which exposed an API used to pull consumer information. The breach revealed a vulnerability in 700Credit’s validation process. Sign up for CBT News’ daily newsletter and get the latest industry stories delivered straight to your inbox. On Oct. 25, hackers launched a sustained velocity attack that continued for more than two weeks. Although 700Credit shut down the exposed API, attackers still managed to obtain about 20% of consumer data from May to October 2025. The attack did not penetrate 700Credit’s internal systems, which remained operational throughout the incident. "I wanted to be able to tell our customers that we've done everything we could." Hill urges dealership groups of all sizes, particularly those with limited cybersecurity budgets, to prioritize education and adopt best practices to reduce the risk of becoming targets. 700Credit, in partnership with the National Automobile Dealers Association (NADA), coordinate