Incident Types: The types of cybersecurity incidents that have occurred include Breach.

Detection and Response: The company detects and responds to cybersecurity incidents through an incident response plan activated with yes, and third party assistance with forensic specialists, and remediation measures with reviewing and updating policies, procedures, and processes related to the storage and access of personal information, and communication strategy with disclosure to california and maine attorney generals' offices, call center setup for affected individuals, and incident response plan activated with yes, and containment measures with isolating the partner integration issue, managing customer communication, and communication strategy with dealers receiving branded notices and helplines..

Common Attack Types: The most common types of attacks the company has faced is Breach.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Web Application and Compromised partner system.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Full Names, Addresses, Dates Of Birth, Social Security Numbers, Employment Information, and Customer information (PII).

Incident Response Plan: The company's incident response plan is described as Yes, Yes.

Third-Party Assistance: The company involves third-party assistance in incident response through Forensic specialists.

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Reviewing and updating policies, procedures, and processes related to the storage and access of personal information.

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by isolating the partner integration issue and managing customer communication.

Key Lessons Learned: The key lessons learned from past incidents are Vendor oversight and data-security readiness are critical for preventing similar incidents.

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Enhance vendor security assessments, improve API security controls and and strengthen monitoring of partner integrations..

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Hacking forum post by ROOTBOYDate Accessed: 2025-11-16, and Source: CDG Newsletter.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Disclosure to California and Maine Attorney Generals' offices, call center setup for affected individuals and Dealers receiving branded notices and helplines.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Call center setup at 833-586-1820, Monday through Friday, 8 a.m. to 6 p.m. ET, Dealers advised to manage customer communication and monitor for potential fraud. and Branded notices and helplines provided to affected consumers..

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Forensic specialists.

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Reviewing and updating policies, procedures, and processes related to the storage and access of personal information, Isolate partner integration, enhance API security, and improve vendor oversight.

Last Attacking Group: The attacking group in the last incident was an ROOTBOY.

Most Recent Incident Detected: The most recent incident detected was on 2025-10-25.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-12-12.

Most Significant Data Compromised: The most significant data compromised in an incident were Personally Identifiable Information (PII) and Customer information tied to valid IDs.

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was Forensic specialists.

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Isolating the partner integration issue and managing customer communication.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Personally Identifiable Information (PII) and Customer information tied to valid IDs.

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 14.0M.

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Vendor oversight and data-security readiness are critical for preventing similar incidents.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Enhance vendor security assessments, improve API security controls, and strengthen monitoring of partner integrations., Sign up for free Cyberscout credit monitoring services, Be alert for phishing emails or phone calls, Monitor credit reports and financial accounts for unusual activity and Consider placing a fraud alert or credit freeze with major credit bureaus.

Most Recent Source: The most recent source of information about an incident are Hacking forum post by ROOTBOY and CDG Newsletter.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing.

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Dealers advised to manage customer communication and monitor for potential fraud., .

Most Recent Customer Advisory: The most recent customer advisory issued were an Call center setup at 833-586-1820, Monday through Friday, 8 a.m. to 6 p.m. ET and Branded notices and helplines provided to affected consumers.

Most Recent Entry Point: The most recent entry point used by an initial access broker were an Web Application and Compromised partner system.

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Partner system compromise leading to unauthorized API access.

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Reviewing and updating policies, procedures, and processes related to the storage and access of personal information, Isolate partner integration, enhance API security, and improve vendor oversight.