CORPAY, INC.
bd_b944460ec8f5cee6 · schema v1 · pii pii-v2
Full breach record for CORPAY, INC. →Corpay, Inc. notified the NH Attorney General of a security incident involving approximately 3 New Hampshire residents. On or around November 21, 2025, Corpay became aware that an unauthorized actor used social engineering to access the online payment portal hosted for customer Swift Transportation Co., LLC. The actor accessed the portal between November 17 and November 21, 2025, viewing or taking information including names, driver's license numbers, employee IDs, and OnRoad payment card details (number, expiration, security code). Corpay contained the incident, blocked access, reset PINs, replaced cards, and reimbursed suspicious payments. Affected individuals are offered 12 months of credit monitoring.
J jump to incidentP pin to compareR raw source
Incident timeline
Nov 17, 2025
Begins
Nov 21, 2025
Discovered
Sep 22, 2026
Filed
vs. sector median
+35 wks slower
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- Vermont State AGbd_15fa682368cf387a2026-09-21 · +1dVerified
- South Carolina State AGbd_79b84e9e2e3a93b62026-09-21 · +1dCandidate
- Indiana State AGbd_eede779676c9ba8d2026-09-21 · +1dVerified
- Texas State AGbd_61deb96841c4e8d62026-09-25 · +3dVerified
Show 1 more filing ↓Show fewer ↑up to 21d gap
- Massachusetts State AGbd_37c9369b564eac5b2026-09-01 · +21dVerified
Filing propagation · 6 filings · 6 states
View merged incident ↗Pattern: first filing Sep 1 (MA), last Sep 25 (TX) — a 24-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.