Doxim doxim.com Doxim data breach 2023: what happened and what to do
Doxim, a company that prepares statements and tax forms for credit unions, detected suspicious activity on December 30, 2023. Notices went out from May 2024. The data may include names, addresses, financial account numbers and Social Security numbers. No total has been published.
View all 13,115 breaches- Breach date
- 30 Dec 2023
- Made public
- 14 Jun 2024
- Data exposed
- Names, Physical addresses, Financial account numbers, Social security numbers
- Last updated
What happened
Doxim is a software company that prepares statements, tax forms and other documents for banks and credit unions. It is not a brand most people know, which is the awkward part of this breach: you could be a member of a credit union and learn about the incident only from a letter with a company name you have never heard of.
According to Doxim's notice letters, the company detected suspicious activity on December 30, 2023 in the part of its network that supports its credit union services. It began notifying people at the end of May 2024, and the incident then appeared on the California Attorney General's breach list in June 2024. Several credit unions posted their own notices telling members that Doxim had handled their data.
Doxim has not published a total number of people affected. The 943 residents shown on the Washington Attorney General's site is a single-state count, and the full figure is larger. A separate Doxim incident in August 2024 affected its Canadian operations and is a different matter.
What was exposed
The notices and the class action notice say the information may include names, addresses, financial account numbers and Social Security numbers. What was involved differed by person, so your own letter is the authority on your data.
A Social Security number plus an account number is the combination that matters. With it, criminals can try to open credit in your name, file false tax returns or attempt account takeover at your financial institution.
What it lets criminals do
Because Doxim served credit unions, the likely scams are phone calls and texts that appear to come from your credit union. A caller who knows your name, address and part of your account number sounds real. Credit unions normally won't ask you to read out a one-time passcode, and a real staff member will let you call back on the number printed on your card.
The Social Security number is the longer-lasting risk. Unlike a password, it can't be reset, so a credit freeze is the reliable defence.
Settlement
A class action over the incident reached a proposed settlement of $5.5 million, according to settlement summaries. Reported claim deadlines may already have passed, so check the official settlement website for the current status before relying on any date.
Check your own exposure
Your notice letter is the main source. A free Serus scan also checks whether your email and phone number appear in breaches and keeps watching. Serus can't remove data from a breach, but it alerts you when your details show up somewhere new. Your credit union can tell you whether it used Doxim.
What to do if you were in it
- 1
Read your notice and take the monitoring offered
The letter says what applies to you and how to enroll in any free credit monitoring. Your credit union may also have posted a notice.
- 2
Freeze your credit
Freezing your credit at Equifax, Experian and TransUnion is free and stops anyone opening new credit in your name. You can lift it when you need to apply for something. This matters most because your Social Security number may be involved.
- 3
Watch your credit union account
Check statements for transactions you don't recognise and set up balance and transfer alerts.
- 4
Don't trust calls or texts about your account
If someone contacts you about the breach or your account, hang up and call the number on your card or statement. Never read out a one-time code.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see where your email and phone number have been exposed, and get an alert when they appear in a new breach.
Frequently asked
Was I affected by the Doxim data breach?
Doxim and credit unions sent notice letters starting in May 2024. If you are a credit union member and got one, you were affected. Letters differ by person.
What was exposed?
The notices say names, addresses, financial account numbers and Social Security numbers may have been involved.
How many people were affected?
No total has been published. The Washington figure of 943 residents counts one state only.
Is there a settlement?
A $5.5 million class action settlement was proposed, according to settlement summaries. Check the official settlement site for the current status and deadlines.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
