AutoZone autozone.com AutoZone data breach: what happened and what to do
AutoZone, the US auto parts retailer, reported that a hack of its MOVEit file transfer software, which began on 28 May 2023, exposed data on about 185,000 people. The notice says full names and Social Security numbers were taken.
View all 13,115 breaches- Breach date
- 28 May 2023
- Made public
- 20 Nov 2023
- Affected
- 184,995
- Data exposed
- Names, Social security numbers
- Last updated
What happened
AutoZone uses MOVEit, a file transfer application. In 2023 attackers exploited a vulnerability in MOVEit at many organizations at once. AutoZone's notice says the vulnerability was exploited on or around 28 May 2023, and that on or about 15 August 2023 the company determined that certain data had been taken.
AutoZone's filing with the Maine Attorney General listed 184,995 people as affected, according to SecurityWeek. The company reported the incident to the California Attorney General in November 2023.
What was exposed
The notice names full names and Social Security numbers. A Social Security number is the key piece for identity theft: with a name and number, a criminal can try to open credit accounts, file a fake tax return or take out loans in your name. It also lets scammers sound convincing when they phone or write to you.
The company's response
AutoZone says it disabled the MOVEit application, rebuilt the affected system and patched the vulnerability. According to Dark Reading, it offered affected people credit monitoring through Equifax. Reports at the time said the company knew of no fraud tied to the data.
What it means for you
If AutoZone sent you a letter, take the credit monitoring offer, and freeze your credit as well. Monitoring tells you about new accounts after they open. A freeze stops most of them from opening.
What to do if you were in it
- 1
Freeze your credit
Place a free credit freeze at Equifax, Experian and TransUnion. It blocks most new accounts opened in your name, and you can lift it whenever you apply for credit yourself.
- 2
Watch statements and credit reports
Check your bank, card and insurance statements for anything you don't recognize, and review your reports at annualcreditreport.com.
- 3
Expect phishing that mentions the breach
Emails, texts and calls may quote real details about you. Don't click links or give out information; go to the company's site yourself.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak.
Frequently asked
Was I affected by the AutoZone data breach?
Affected people received a letter from AutoZone. If you didn't get one, you were most likely not in the notified group.
What was exposed?
AutoZone's notice names full names and Social Security numbers.
Should I change my password?
The notice doesn't mention passwords or account logins. Your Social Security number is the main risk, so a credit freeze matters more.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
