Ally Bank ally.com Ally Bank data breach 2018: what happened and what to do
In November 2018, a third-party supplier sent files with Ally home loan applicants' personal information to another financial institution by mistake. The files could include Social Security numbers, dates of birth, credit scores and income. Ally said the other institution deleted them.
View all 13,115 breaches- Breach date
- 11 Nov 2018
- Made public
- 13 Dec 2018
- Data exposed
- Names, Phone numbers, Email addresses, Social security numbers, Dates of birth, Credit scores, Income information, Employment information
- Last updated
What happened
Ally Bank said it found in November 2018 that a third-party supplier had sent files containing personal information to another financial institution by mistake. Ally mailed a notice dated December 12, 2018, and filed a sample with the California Attorney General the next day. Ally did not state how many people were affected.
This was a mistaken transfer, not a hack. According to Ally, the receiving institution reported the error right away and deleted the files. Ally said it had no reason to believe the information was misused, and that the supplier changed its procedures and retrained staff.
What was exposed
The files held what people had provided when they applied for a home loan with Ally. Per the notice, that may include:
- First and last name, phone number and email address
- Social Security number and date of birth
- Credit scores, monthly income, employer name, job title and dates employed
A Social Security number combined with a date of birth and income details is enough for someone to try to open credit in your name or to write a convincing phishing message about your loan.
What Ally offered
Ally paid for two years of Equifax Credit Watch Gold with 3-in-1 monitoring and $1 million of identity fraud expense coverage. Enrollment had to be completed by January 31, 2019.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
Place a free freeze at Equifax, Experian and TransUnion, separately at each. It blocks most new accounts opened in your name, and you can lift it when you apply for credit yourself.
- 2
Check your credit reports
Get your free reports at annualcreditreport.com and look for accounts or inquiries you don't recognize. Repeat every few months for a year.
- 3
Be wary of messages about your home loan
Your lender, income and employer were in the files. Treat unexpected calls, texts or emails about your mortgage as suspect and contact Ally through the number on its website.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak.
Frequently asked
Was I affected by the Ally Bank data breach?
People who applied for a home loan with Ally and were in the files received a notice letter. If you didn't get one, you were not told you were affected.
What was exposed in the Ally Bank data breach?
Names, phone numbers, email addresses, Social Security numbers, dates of birth, credit scores, monthly income and employment details may have been in the files.
Was this a hack?
No. Ally said a third-party supplier sent the files to another financial institution by mistake, and that institution deleted them.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
