DriveSure Data Breach

What happened?

In December 2020, the car dealership service provider DriveSure suffered a data breach . The incident resulted in 26GB of data being downloaded and later shared on a hacking forum. Impacted personal information included 3.6 million unique email addresses, names, phone numbers and physical addresses. Vehicle data was also exposed and included makes, models, VIN numbers and odometer readings. A small number of passwords stored as bcrypt hashes were also included in the data set.

When did it happen?

The breach date in the public record is December 19, 2020. The record was added to the catalogue on May 10, 2021 and last updated there on May 10, 2021.

What information was reported as exposed?

• Email addresses
• Names
• Passwords
• Phone numbers
• Physical addresses
• Vehicle details

These are incident-level categories. The record does not prove that every category was exposed for every affected person.

Who may be affected?

This record may be relevant to people who had an account or other relationship with DriveSure or used drivesure.com around December 19, 2020. A catalogue entry does not establish that every customer was affected or that every listed data category applied to each person. Compare the record with an official notice addressed to you.

What should you do?

Choose actions that match the information involved. If you find signs that someone is using your identity, the Federal Trade Commission provides a personal recovery plan at IdentityTheft.gov.