Auto Approve autoapprove.com Auto Approve data breach: what happened and what to do
Auto Approve, an auto lender, told customers in 2019 that a flaw exposed loan files to outside access for about three weeks. The notice lists names, addresses, Social Security numbers, dates of birth, loan details and vehicle information. The company found no access beyond the researcher who reported it.
View all 13,177 breaches- Breach date
- 28 Aug 2019
- Data exposed
- Names, Physical addresses, Social security numbers, Dates of birth, Loan details, Vehicle information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Auto Approve, LLC is an auto lender. In late 2019 it sent customers a notice of data breach and the incident was listed with the California Attorney General in October 2019.
According to the notice, a security researcher alerted the company to a vulnerability on September 15, 2019. The flaw appeared after a routine maintenance release and left data tied to auto loans reachable by outside parties for about three weeks.
Sources checked: dojmt.gov, oag.ca.gov, consumer.ftc.gov
Last verified against the official page:
What was exposed
The notice lists names, addresses, Social Security numbers, dates of birth, loan information, and vehicle details such as make, model and VIN.
That mix matters more than a leaked email address. A Social Security number with a date of birth and a home address is what criminals need to apply for credit in someone else's name. Loan and vehicle details also make a fake call or letter from "your lender" sound believable.
The company's response
Auto Approve says it fixed the problem and re-secured the information. It also says it found no evidence that anyone accessed the data other than the security researcher and an affiliate of the researcher. The company offered 24 months of free credit monitoring and identity protection.
Auto Approve has not published how many people were affected, so no total is stated.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A credit freeze is free and stops anyone opening new credit in your name. Place one at Equifax, Experian and TransUnion; the FTC explains how. Do this first if you ever had a loan with Auto Approve.
- 2
Use the free credit monitoring if you still can
Auto Approve offered 24 months of free credit monitoring. The FTC recommends taking such offers. If you kept your letter, check whether the enrollment deadline has passed, and if it has, a credit freeze still protects you.
- 3
Expect phishing that mentions the breach
Anyone who knows you had an auto loan can pose as a lender or collector. Don't click links or call numbers in unexpected messages. Go to the company's own website instead, and report scams at ReportFraud.ftc.gov.
- 4
Report misuse and watch your reports
Check your credit reports at annualcreditreport.com. If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
- 5
Check whether your email or phone is in other breaches
A free Serus scan checks breach databases for your email address and phone number, so you know what else is out there. Serus can't remove breach data, but it alerts you when your details turn up and tells you what to do.
Official filings
- California Attorney General , filed 28 Oct 2019
Timeline
-
The breach happened
-
Reported to the California Attorney General
Frequently asked
Was I affected by the Auto Approve breach?
If Auto Approve sent you a notice of data breach in 2019, yes. If you have not received one, you were not notified as affected, but you can ask the company directly.
What was exposed in the Auto Approve breach?
Names, addresses, Social Security numbers, dates of birth, loan information and vehicle details including the VIN.
Did anyone actually access the data?
Auto Approve says it found no evidence of access beyond the security researcher who reported the flaw and an affiliate of that researcher.
Should I freeze my credit?
Yes, if your Social Security number was in the notice. A freeze is free at all three bureaus and you can lift it whenever you apply for credit.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
