HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
AutoNation, Inc.
bd_c158c2a75bf30f3e · schema v1 · pii pii-v1
Full breach record for AutoNation, Inc. →CrossCheck, Inc. reported a cybersecurity incident affecting AutoNation, Inc. customers. Between May 18-20, 2024, an unauthorized actor accessed CrossCheck's merchant portal, potentially exposing names, driver's license numbers, and financial account information of 299 Maryland residents. CrossCheck notified federal law enforcement, provided 12 months of credit monitoring via Experian, and implemented additional employee safeguards. Notification to the Maryland Attorney General was filed on March 4, 2025.
Maryland clock✗ MD AG >90d41 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed299 affectedView incident
Source provenance
- Source URL
- https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376502.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 4, 2025
- Raw hash
- ee91c248a20858e9cd8c2e981e82cc8d16a19bb136ef9785260736a9d4df73bc
Reporting entity
- Name
- CrossCheck, Inc.norm: crosscheck
Victim entity
- Name
- AutoNation, Inc.norm: autonation
- Domain
- autonation.com
- Industry
- retail_consumer
Incident
- Discovered
- May 20, 2024
- Materiality determined
- —
- Notification sent
- Mar 4, 2025
- Affected individuals
- 299
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Regulator citations
- Providing written notice of this incident to relevant state regulators, as necessary
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 41 weeks(288 days from discovery to filing)
- Compliance flags
- MD AG >90d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.