CORPAY, INC.
ent_019fa229ad45d150a70c3fa0e21a8919
Disclosures
6
State AG · 6 jurisdictions
Multi-filing incidents
1
incidents joining 2+ filings here
Max affected reported
28,473
nationwide · State AG TX
Leak-site claims
0
none in sample
Identity resolution
- Canonical name
- CORPAY, INC.
- Normalized
- corpay— dedupe via name-norm; Microsoft / MSFT collapse to one row
- GLEIF LEI
- 549300DG6RR0NQSFLN74
- SEC EDGAR CIK
- 0001175454
- Domain
- None on record
Disclosure history (6)newest first
- Texas State AGas victim2026-09-25
Corpay, Inc. based in Brentwood, Tennessee, a other entity reported a data breach to the Texas Attorney General. The breach was discovered on 2025-11-21 and reported on 2026-09-25. 3,225 Texas residents were affected. 28,473 individuals affected in total. Types of information involved: Name of individual;Driver’s License number. Consumers were notified via U.S. Mail.
- New Hampshire State AGas victim2026-09-22
Corpay, Inc. notified the NH Attorney General of a security incident involving approximately 3 New Hampshire residents. On or around November 21, 2025, Corpay became aware that an unauthorized actor used social engineering to access the online payment portal hosted for customer Swift Transportation Co., LLC. The actor accessed the portal between November 17 and November 21, 2025, viewing or taking information including names, driver's license numbers, employee IDs, and OnRoad payment card details (number, expiration, security code). Corpay contained the incident, blocked access, reset PINs, replaced cards, and reimbursed suspicious payments. Affected individuals are offered 12 months of credit monitoring.
- Vermont State AGas victim2026-09-21
Corpay, Inc. reported a data breach to the Vermont Attorney General. The breach was reported to the AGO on 2026-09-21. The reporting organization type is Other Commercial. 3 Vermont residents were affected. Categories of data breached: Government ID Numbers.
- South Carolina State AGas victim2026-09-21
Corpay, Inc. disclosed that an unauthorized actor accessed the ICD Portal hosted for Swift Transportation Co., LLC between November 17 and November 21, 2025. Corpay became aware of the incident on November 21, 2025. The breach potentially exposed names, driver's license numbers, employee IDs, and OnRoad payment card details (number, expiration, security code) for Swift drivers and representatives. Corpay contained the incident, blocked access, reset PINs, replaced cards, and offered 12 months of credit monitoring. The notice was sent on September 21, 2026.
- Indiana State AGas victim2026-09-21
Corpay, Inc reported a data breach to the Indiana Attorney General. The breach occurred on 2025-11-17 and was reported on 2026-09-21. 573 Indiana residents were affected. 28,473 individuals affected in total.
- Massachusetts State AGas victim2026-09-01
Corpay, Inc. disclosed that an unauthorized actor accessed the ICD Portal hosted for Swift Transportation Co., LLC between November 17 and November 21, 2025. Corpay became aware of the incident on November 21, 2025. The actor may have obtained OnRoad card information, including name, driver's license number, employee ID, card number, expiration date, and security code. Corpay contained the incident, blocked access, reset PINs, replaced cards, and reimbursed suspicious payments. Affected individuals are offered 12 months of credit monitoring.
Subsidiary disclosures (newest 10)filed by group companies
◈ These filings were made by or about subsidiaries of CORPAY, INC. — not by CORPAY, INC. itself. Corporate relationships are mapped from GLEIF relationship records and SEC Exhibit 21 filings.
- Indiana State AGvia CAMBRIDGE MERCANTILE CORP. (U.S.A.)2026-09-14
Cambridge Mercantile Corp reported a data breach to the Indiana Attorney General. The breach occurred on 2026-06-11 and was reported on 2026-09-14. 15 Indiana residents were affected. 2,734 individuals affected in total.
- California State AGvia CAMBRIDGE MERCANTILE CORP. (U.S.A.)2026-09-14
Cambridge Mercantile Corp. (U.S.A.) (Corpay) notified the California AG of a data breach involving a third-party vendor, Klue. Between June 11-12, 2026, an unauthorized party accessed Corpay's CRM data via Klue's infrastructure. Affected data includes names and contact details. No credentials or financial data were compromised. Corpay engaged experts, notified law enforcement, and offered identity monitoring.
- Massachusetts State AGvia CAMBRIDGE MERCANTILE CORP. (U.S.A.)2026-09-01
Cambridge Mercantile Corp. (U.S.A.) (Corpay) notified individuals of a data security incident where an unauthorized third party accessed personal information including names and contact details. The investigation was substantially completed on August 28, 2026. No passwords, credentials, or financial funds were compromised. The company engaged third-party experts, enhanced security safeguards, and provided identity monitoring services via Kroll.
- GLOBALLeak Sitevia Alpha Group Holdings2026-05-24
- Massachusetts State AGvia ASSOCIATED FOREIGN EXCHANGE, INC.2021-01-28
Associated Foreign Exchange, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2021-01-28. 20 Massachusetts residents were affected. The report records the breach type as electronic.
- Oregon State AGvia ALE Solutions, Inc.2021-01-19
ALE Solutions Inc reported a data breach to the Oregon Attorney General. The breach was reported on 2021-01-19. The breach occurred during 4/1/2020 - 6/30/2020. The breach was discovered on 6/1/2020. Notice was sent on 1/11/2021.
- New Hampshire State AGvia ALE Solutions, Inc.2021-01-19
ALE Solutions, Inc. notified the New Hampshire Attorney General of a ransomware incident occurring between April and June 2020. The attack encrypted data and potentially exposed names and SSNs of 106 NH residents. ALE engaged forensic experts, secured its network, implemented MFA, and offered credit monitoring. Notifications were sent in January 2021.
- Maine State AGvia ALE Solutions, Inc.2021-01-19
ALE Solutions, Inc. reported a data breach affecting 109 Maine residents. The breach, an external system hacking incident, occurred between April 1, 2020, and June 1, 2020, and was discovered on December 16, 2020. The compromised information includes names and Social Security numbers. Affected individuals were notified on January 11, 2021, and offered 12 months of complimentary credit monitoring and identity restoration services through TransUnion.
- California State AGvia ALE Solutions, Inc.2021-01-18
ALE Solutions, Inc. suffered a data encryption incident by an unknown external actor. Unauthorized parties may have accessed or downloaded data between April and June 2020. Affected information includes names and Social Security numbers. The investigation was completed on December 16, 2020. Remediation included advanced threat detection, hardened network administration, and multifactor authentication.
- Massachusetts State AGvia ALE Solutions, Inc.2021-01-18
ALE Solutions, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2021-01-18. 423 Massachusetts residents were affected. The report records the breach type as electronic.