2024 Ally Financial — vendor-compromise pathway; SSN/DOB/auto-account fields (regulatory + litigation attention)
Data compromised
Government identifiers and auto-financial account fields per sample regulatory notices
Technical writeup
Ally letters summarized in Massachusetts regulatory mirrors and national press described April 23, 2024 discovery of unauthorized access touching auto-lending customer files via a third-party service provider context—exposing combinations of Social Security numbers, dates of birth, and auto account numbers in consumer-facing notification language. Bloomberg Law and retail coverage highlighted proposed class actions alleging slow customer notice, while Ally offered multi-year identity-protection bundles. Headline “billions” figures in early complaints reflected legal pleading hyperbole, but ~4.2 million individuals surfaces repeatedly in 2024–2025 follow-on docket summaries cited by consumer outlets.
Root cause
Third-party/vendor environment compromise enabling access to Ally customer-record workflows