DriveSure drivesure.com DriveSure data breach: what happened and what to do
DriveSure, a car dealership service provider, had a breach in December 2020 that exposed 3,675,099 accounts in Have I Been Pwned. Names, emails, phone numbers, addresses and vehicle details such as VINs were exposed, plus a small number of password hashes.
View all 13,115 breaches- Breach date
- 19 Dec 2020
- Affected
- 3,675,099
- Data exposed
- Email addresses, Names, Passwords, Phone numbers, Physical addresses, Vehicle details
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
DriveSure provides services to car dealerships. Have I Been Pwned lists 3,675,099 accounts from a breach it dates to December 19, 2020.
What happened
About 26GB of data was downloaded and later shared on a hacking forum. Risk Based Security found the databases there in early January 2021 and traced them to DriveSure, an Illinois company owned by dealership service provider Krex. It said DriveSure responded promptly and was investigating.
What was exposed
Unique email addresses, names, phone numbers and physical addresses. Vehicle data was also exposed: makes, models, VIN numbers and odometer readings. A small number of passwords stored as bcrypt hashes were included.
What that means for you
A name, phone number and a car's VIN and mileage is a strong set for car scams. Risk Based Security warned the data is prime for insurance scams, and it also suits fake warranty calls and dealership impersonation. Most of the people affected didn't have a DriveSure account of their own, only a dealership relationship. That makes the breach easy to miss, so check your email address on Have I Been Pwned rather than assuming you were never involved.
What to do if you were in it
- 1
Expect phishing that mentions DriveSure
Names, emails and phone numbers let scammers write believable messages. Treat unexpected emails and texts that mention DriveSure or your orders with suspicion, and go to the site directly instead of clicking links.
- 2
Hang up on warranty and insurance pitches that know your car
Scammers use vehicle details to sound legitimate. Don't give payment details or personal information to a caller who contacted you. Call your dealer or insurer using a number you looked up yourself.
- 3
Change your DriveSure password and anywhere you reused it
The passwords were stored as bcrypt hashes, which attackers can crack, especially weak ones. Pick a new, unique password for DriveSure and for any other account that shared it. A password manager makes that painless.
- 4
Tell your insurer if something looks off
If you get claims, quotes or policy changes you didn't ask for, contact your insurer directly.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data appears, so you hear about the next one early. It can't remove data from a breach, so the alert is the useful part.
Frequently asked
Was I affected by the DriveSure breach?
Check your email on Have I Been Pwned, which lists 3,675,099 accounts. You may be in it through a dealership even if you never used DriveSure yourself.
What vehicle data was exposed?
Makes, models, VIN numbers and odometer readings.
Were passwords exposed?
A small number of bcrypt hashed passwords were in the data.
Should I change my password?
Only if you had a DriveSure login. Change it and anywhere you reused it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
