Money Mart Data Breach Exposes Customers’ Sensitive Personal Information Money Mart, a financial services provider, recently disclosed a data security incident involving unauthorized access to customers’ sensitive personal information. The breach raises concerns about the exposure of financial and personal data, though specific details on the scope, timeline, and affected parties remain limited. The incident highlights ongoing risks in the financial sector, where cybercriminals increasingly target customer data for fraud or exploitation. While the company has not released further technical details, the disclosure underscores the need for robust security measures in handling sensitive information. No additional context on the attack vector, responsible threat actors, or regulatory responses has been provided at this time. The breach follows a pattern of recent cyber incidents affecting financial and corporate entities globally.

Money Mart Data Breach Exposes Personal Information in November 2025 Attack Payday loan provider Money Mart has begun notifying victims of a November 2025 data breach that exposed names and Social Security numbers. The company confirmed that hackers infiltrated a third-party application, though it did not disclose the vendor’s identity. The ransomware group Everest claimed responsibility for the attack, alleging it stole 80,000 files, including personal data of U.S. and Canadian customers and internal employee documents. Money Mart has not verified Everest’s claims, and key details such as the number of affected individuals, ransom demands, or breach methods remain undisclosed. The company’s forensic investigation is ongoing. In a notice to victims, Money Mart stated that unauthorized access to files in a third-party application was detected in early December 2025, with evidence suggesting personal data was accessed and exfiltrated. As a remedy, the company is offering 12 months of free credit monitoring through TransUnion, with enrollment open until April 30, 2026. Everest, active since 2020, has a history of high-profile attacks, including breaches at NASA, the Brazilian government, and multiple healthcare providers. After a lull in 2022–2023, the group resurfaced in 2024 and has since claimed 11 confirmed ransomware attacks in 2025, targeting sectors like aerospace (Collins Aerospace), aviation (Dublin Airport), and finance. Money Mart marks its second financial services victim this year, following a June 2025 attack on New American Funding, where Everest allegedly stole 350 GB of data. The group has also claimed 73 unconfirmed attacks in 2025 that remain unverified by affected organizations. The breach aligns with a broader surge in ransomware attacks on U.S. financial firms. In 2025 alone, researchers recorded 50 confirmed incidents, compromising over 700,000 records. Notable examples include a January 2025 breach at Wakefield & Associates (371,577 affected, claimed by Akira) and a February 2025 attack on CRC Group (60,727 affected, claimed by LeakedData). Such attacks often involve data theft and system encryption, with threat actors demanding ransoms to prevent leaks or restore access. Money Mart, a subsidiary of Momentum Financial Services Group, operates over 420 branches across North America and serves 1.6 million customers, offering cash advances and installment loans. The company, formerly known as Dollar Financial Group, also owns brands like The Check Cashing Store and Centz.