GENERAL MOTORS COMPANY

Between May 18–20, 2024, unauthorized parties used previously compromised credentials from non-GM sites (credential stuffing) to access 65 GM MyAccounts on the GM accessories website, making fraudulent purchases. Exposed data included name, address, phone number, and last four digits of saved payment card. No GM-sourced credential breach was identified. GM forced password resets, implemented MFA, refunded fraudulent purchases, and notified law enforcement. Two Maine residents were affected.