GENERAL MOTORS COMPANY

General Motors Company (GM) filed its 10-K Item 1C disclosing its cybersecurity risk management and strategy. The filing explicitly states that GM has not experienced any material cybersecurity incidents and that expenses from cybersecurity incidents were immaterial, including penalties and settlements. The company describes its governance structure, including a Cybersecurity Management Board and a CISO reporting to the Board's Risk and Cybersecurity Committee, but reports no specific breach events.

Between May 18–20, 2024, unauthorized parties used previously compromised credentials from non-GM sites (credential stuffing) to access 65 GM MyAccounts on the GM accessories website, making fraudulent purchases. Exposed data included name, address, phone number, and last four digits of saved payment card. No GM-sourced credential breach was identified. GM forced password resets, implemented MFA, refunded fraudulent purchases, and notified law enforcement. Two Maine residents were affected.

General Motors Company reported a data breach to the Indiana Attorney General. The breach occurred on 2024-05-18 and was reported on 2024-06-26. 2 Indiana residents were affected. 65 individuals affected in total.

General Motors Company notified the California Attorney General of a data incident affecting 4,920 California residents. Between April 11 and April 29, 2022, unauthorized parties used credentials previously compromised on other sites to access GM online accounts. Affected data included names, emails, addresses, phone numbers, location data, and search history. GM suspended gift card redemptions, forced password resets, and reported the incident to law enforcement.

General Motors Company reported a data breach on May 11, 2022, affecting 141 individuals, including 1 Maine resident. The incident involved unauthorized access to a non-financial online account, compromising names and account passwords. The breach occurred and was discovered on April 11, 2022. Electronic notifications were sent to affected consumers on May 11, 2022.

General Motors Company reported that an unauthorized third party gained access to customer online accounts using their name and password.