2026 Challenge Financial Services — Aug 17–18 network access; names/SSNs/addresses/DOB
Data compromised
Names; Social Security numbers; addresses; and/or dates of birth (may have been viewed or taken from affected files — company notice)
Technical writeup
Challenge Financial Services, a California auto-loan servicer (Orange, CA), published a Notice of Data Event stating that on August 31, 2026 it discovered a cyber incident impacting a limited portion of its network. Investigation determined an unauthorized third party had access from August 17 to August 18, 2026, and that certain files containing customer personal information may have been viewed or taken. Affected files may have contained names plus Social Security numbers, addresses, and/or dates of birth. The company restored systems, notified law enforcement, began consumer notices after file analysis, and offered 12 months of IdentityIQ credit monitoring/identity restoration (enroll by December 15, 2026). No headcount was published in the notice — recordsAffected 0. Class-action investigators began soliciting affected consumers around September 30, 2026. companyConfirmed true.
Root cause
Cyber incident on a limited portion of the network; unauthorized third party accessed the environment Aug 17–18, 2026 (company notice)