700kredit $17,5 millioner forlig sætter en September Deadline på fordringer efter 5,8 millioner bil købere blev udsat

The claim window on the 700Credit breach is measured in days, not quarters. Class members who want cash from the $17.5 million deal have until September 22, 2026, to file. The deadline to opt out or object is September 8. A federal judge in Michigan has the final-approval hearing on the calendar for October 7 at 2 p.m. The people inside that class handed a dealership a license and a Social Security number so they could finance a car, an RV, a boat, or an ATV. They did not hand those numbers to a stranger on a forum. The stranger got them anyway.

Oregon’s attorney general counted 5,836,521 affected consumers across roughly 18,000 U.S. dealerships. The platform was 700Dealer.com. The date 700Credit says it detected the incident is October 25, 2025. Names, dates of birth, Social Security numbers, and other identifiers sat behind an application programming interface that did not check whether a requested file belonged to the dealer who was asking. That is not ransomware folklore. That is a missing ID check. (700Kreditafviklingssted)

En partnernøgle og et hastighedsangreb

Angribere først ramte en lille tredjeparts butik, der håndterede finansiering arbejde for uafhængige forhandlere og talte med 700Credit hver dag. De læste, at sælgers logfiler, stjal API legitimation og en dekrypteringsnøgle, og udgav sig for en rigtig klient. Partnen advarede ikke 700Credit.

Ken Hill, 700Credit’s managing director, later said the sentence the industry did not want on tape: “We weren’t validating the consumer reference IDs to the original requestor.” Anyone holding stolen partner keys could throw guessed IDs at the API and pull files that belonged to some other lot. On October 25 the crew ran a velocity attack for about 90 minutes before 700Credit killed the integration. Hill said they scraped about 20 percent of the consumer records collected between May and October. (Amerikansk bankvirksomhed)

Ingen skulle plante malware på det interne netværk. Skaden var ansøgningslaget plus en partner, der allerede havde en legitim dekrypteringsnøgle. De har forladt en kreditforretning uden en server.

ROOTBOY, en løsesum argument, og en Michigan docket

Hill described “heated conversations” about paying the attackers. He would not confirm a payment and said the company was proceeding as if the data had been contained. On November 16, 2025, a handle calling itself ROOTBOY advertised about 8.4 million 700Credit records. Trusting the word of the person who attacked you is not a containment strategy. It is a hope.

Første klasses klage landede 24. november 2025. Den 10. februar 2026, en dommer i det østlige distrikt Michigan konsolideret dragterne som I re 700 Kreditdatasikkerhed retssagForeløbig godkendelse af en $17,5 millioner forlig fulgt i juni. 700Credit indrømmer ingen fejl. Aftalen tilbyder to cash tracks og kredit overvågning. Nærmere oplysninger og ansøgningsskema 700creditdatachsettlement.com.

Hvad de $17,5 millioner faktisk køber

Class members who got an email or postcard in July or August 2026 can choose reimbursement of documented ordinary losses up to $2,500, or an alternative cash payment of $50. Both figures can shrink if the claim pile is large. Eligible expenses described in settlement explainers include bank fees, postage, local travel tied to cleaning up the mess, and money already spent on credit reports, monitoring, or identity-theft products before the claim deadline. (Påstand Depot, Top klasse handlinger)

To års kreditovervågning er det automatiske spor. Aktiveringskoderne gik ud med meddelelserne. De virker ikke, før dommeren har godkendt forliget. Intet binder et klassemedlem til udgivelsen. Intet efterlader overvågningskoden på bordet og kontanterne på gulvet.

Seventeen million dollars divided by 5.8 million Social Security numbers is not a lottery ticket. It is a claims process. People who can document fraud get the higher cap, subject to pro rata cuts. People who cannot document a dollar of loss get the $50 option, also subject to cuts. That math is why the September 22 date is the only date that matters for anyone who intends to be paid.

Forhandlere fik papirarbejde høflighed. Købere gjorde ikke

Auto dealers are financial institutions under the FTC Safeguards Rule. A breach at a shared vendor would have forced thousands of duplicate filings. The National Automobile Dealers Association worked with 700Credit and the FTC on a consolidated notice so each lot would not file the same incident. Dealers still had to follow state consumer-notice laws. 700Credit mailed letters and offered Cyberscout monitoring in the first wave.

The federal courtesy did not end the pressure. The FTC sent warning letters to 97 dealerships in March 2026. Michigan Attorney General Dana Nessel, with about 160,000 residents in the blast radius, told people not to ignore the letter. South Carolina counted 108,829 residents. At least ten attorneys general received notice. A one-time pass on duplicate federal forms is not a finding that the lots ran a clean vendor program.

Anyone who applied for financing through a 700Credit dealer between May and October 2025 should treat the identifiers as exposed. Freeze credit at Equifax, Experian, and TransUnion. File the claim if the notice arrived. Assume a dark-web listing is not a rumor when the handle already advertised the file.

Udbyderrisiko er produktet

Car lots did not build 700Dealer.com. Buyers did not choose 700Credit. The finance office chose a pipeline, and the pipeline trusted a smaller partner, and the smaller partner kept logs and a key that turned into a skeleton key. That chain is the story The AEGIS Alliance keeps hitting on this beat. The Mixpanel hændelse, der spildte Pornhub Premium konto data er et andet mærke og den samme geometri: navnet på hjemmesiden er kun så stærk som analytics shop ingen har hørt om. EU Tricolor auto- lender kollaps er den anden halvdel af partiet - kredit fil og lån bånd bor i samme kvarter. EU IRS- impostor fjernadgangsbølge er, hvad der sker, når et socialsikringsnummer allerede er i omløb.

Hill 's citat om reference-id' er er den del, der bør overleve afviklingen PDF-fil Authentication, der stopper ved "ved denne partner kodeordet" er ikke autentificering af kunden. Det er autentificering af et stjålet skilt.

Datoer der ikke bevæger sig

September 8, 2026: last day to opt out or object, postmarked. September 22, 2026: last day to submit a claim, online or postmarked. October 7, 2026, 2 p.m.: final approval hearing. No benefits pay out unless the court signs the deal. 700Credit still denies wrongdoing. ROOTBOY’s listing is not a court exhibit that has to be true in every row. It is a reminder that once a credit file is copied, the copy does not come back.

The AEGIS Alliance is not a claims mill. This rewrite exists because a six-million-person auto-finance breach is now a claims form with a short fuse, and because the hole that made it possible was a validation step that never ran. If a notice is in a junk folder from July or August, that is the ticket. If it is not, a credit freeze still is. The October hearing will decide whether $17.5 million is enough peace for the company. It will not put the reference IDs back inside the API.