HackingVulnerability ExploitZero-DayData ExfiltratedIDENTITY_GOVERNMENTPIIMediumContained
LKQ CORPORATION
bd_e09da3b67b0dfe83 · schema v1 · pii pii-v1
Full breach record for LKQ CORPORATION →LKQ Corporation notified Vermont AG of a cybersecurity event involving exploitation of previously unknown vulnerabilities in Oracle E-Business Suite. The incident was discovered in early October 2025. LKQ took systems offline and engaged forensic investigators. Impacted data included SSNs and EINs of sole proprietor suppliers. LKQ offered two years of credit monitoring.
Vermont clock✗ VT AG >45 bday10 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 7 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (6) · sorted by filing gap
- bd_0d24498ef978ea45Indiana State AGfiled 2025-12-15Verified
- bd_222597b2166e9a95Maine State AGfiled 2025-12-15Candidate
- bd_3b11067f5766d01dMontana State AGfiled 2025-12-15Verified
- bd_6c3aa51f5e66e7edNew Hampshire State AGfiled 2025-12-15Verified
Show 2 more filings ↓Show fewer ↑up to 1d gap
- bd_f78e0c2f9e23cbd9California State AGfiled 2025-12-15Verified
- bd_9f980168ee3c217dTexas State AGfiled 2025-12-16(1d gap)Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-12-15-lkq-corporation-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 15, 2025
- Raw hash
- 0b1665f7670ddc966b6d10b83a397146fa9223ef03255096840674953704d996
Reporting entity
- Name
- LKQ CORPORATIONnorm: lkq
Victim entity
- Name
- LKQ CORPORATIONnorm: lkq
Incident
- Discovered
- Oct 3, 2025
- Materiality determined
- Dec 15, 2025
- Notification sent
- Dec 15, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_GOVERNMENTPII
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed notice with Vermont Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 10 weeks(73 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.