Check City Data Breach Exposes Sensitive Personal Information of Thousands On March 25, 2026, Check City a cash loan provider operating in multiple states, including Utah and Nevada disclosed a cybersecurity incident that compromised the personal data of thousands of individuals. An unauthorized actor gained access to the company’s network, potentially acquiring sensitive personally identifiable information (PII), including: - Full names - Addresses - Social Security numbers - Driver’s license or government-issued ID numbers - Financial account and payment card details - Dates of birth The breach has prompted an investigation by Lynch Carpenter, LLP, a national class action law firm, which is reviewing potential legal claims on behalf of affected individuals. The firm, with offices in Pennsylvania, California, and Illinois, specializes in data privacy litigation and has represented millions of clients in similar cases over the past decade. No further details on the breach’s origin, scope, or remediation efforts have been released. The incident adds to a growing list of financial service providers targeted by cyber threats, underscoring the persistent risks to consumer data.

Check City Data Breach Exposes Personal and Financial Data of Over 320,000 Individuals Payday loan provider Check City has notified 322,687 individuals of a data breach that occurred in March 2025, exposing sensitive personal and financial information. According to a report by Comparitech, the compromised data includes names, Social Security numbers, government-issued ID numbers, financial account details, credit and debit card numbers, dates of birth, and addresses. The ransomware group Clop claimed responsibility for the breach in May 2025, though Check City has not confirmed the group’s involvement, and Comparitech has not independently verified the claim. Clop, active since 2019, has been linked to 457 ransomware attacks, with 37 confirmed by targeted organizations. The group was previously responsible for the 2023 MOVEit attack, which exposed the email addresses of approximately 632,000 U.S. federal employees at the Department of Defense and the Department of Justice. Check City first detected unauthorized network access on April 3, 2025, and later determined that files may have been accessed by unauthorized individuals around March 21, 2025. After an internal review, the company identified affected individuals on February 17, 2025. While no evidence of fraudulent use has been reported, Check City is offering complimentary credit monitoring services as a precaution. State regulators have also acknowledged the breach. The Texas Office of the Attorney General reported that Check City notified 3,459 Texans via mail, while the California Office of the Attorney General listed the incident on its data security breaches page, noting the breach occurred on April 3, 2025. Check City has not responded to requests for further comment.