HackingData ExfiltratedCustomer Data InvolvedIDENTITY_GOVERNMENTIDENTITY_BASICCriticalContained
TMX Finance Corporate Services, Inc., on behalf of itself, its parent TMX Finance LLC and its affiliates, many of which operate under the brands “TitleMax,” “TitleBucks,” and “InstaLoan” (collectively, “TMX”)
bd_7cfe56600092f0e1 · schema v1 · pii pii-v1
Full breach record for TMX Finance Corporate Services, Inc., on behalf of itself, its parent TMX Finance LLC and its affiliates, many of which operate under the brands “TitleMax,” “TitleBucks,” and “InstaLoan” (collectively, “TMX”) →TMX Finance Corporate Services, Inc. reported an external system breach (hacking) occurring on December 10, 2022, discovered on March 1, 2023. The incident compromised names and Social Security Numbers of approximately 4.8 million individuals, including 81 Maine residents. TMX provided written notification and offered 12 months of Experian IdentityWorks services.
Maine clockDiscovered Mar 1, 2023 → Filed with AG Mar 30, 202329d ✓ ME AG ≤30d29 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed4,822,580 affectedView incident
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/179ab0ce-2c43-4119-ae5a-db766d4be3e0.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 30, 2023
- Raw hash
- 850f5335dde70d7aa83120b6734e68b54ce806048df843676d5556726869cec5
Reporting entity
- Name
- TMX Finance Corporate Services, Inc.norm: tmx finance corporate
Victim entity
- Name
- TMX Finance Corporate Services, Inc., on behalf of itself, its parent TMX Finance LLC and its affiliates, many of which operate under the brands “TitleMax,” “TitleBucks,” and “InstaLoan” (collectively, “TMX”)norm: tmx finance corporate services inc on behalf of itself its parent tmx finance llc and its affiliates many of which operate under the brands titlemax titlebucks and instaloan collectively tmx
Incident
- Discovered
- Mar 1, 2023
- Materiality determined
- —
- Notification sent
- Mar 30, 2023
- Affected individuals
- 4,822,580
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed data breach notice with Maine Office of the Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 29 days(29 days from discovery to filing)
- Compliance flags
- ME AG ≤30d · 29d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Mar 1, 2023→ Filed with AG: Mar 30, 202329d 30 days ME AG ≤30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.