700Credit’s $17.5 Million Claim Window Has Closed for 5.8 Million Car Buyers Ahead of the October Court Hearing

The form is closed. Class members who wanted cash from the $17.5 million 700Credit settlement had until September 22, 2026, to file online or by postmark. The deadline to opt out or object was September 8. Both dates have passed. What remains on the calendar is a hearing, not a second chance at the claim portal: October 7, 2026, at 2 p.m., before U.S. District Judge Robert J. White in the Eastern District of Michigan. No checks move, and the two years of credit monitoring do not switch on, unless he approves the deal. People who stayed silent and did not exclude themselves are still in the class for the release. Silence, after September 22, is no longer a decision waiting to be made.

The class is the crowd that handed a dealership a driver’s license and a Social Security number to finance a car, an RV, a boat, or an ATV. Oregon’s attorney general counted 5,836,521 affected consumers across roughly 18,000 U.S. dealerships. The platform was 700Dealer.com. 700Credit says it detected the incident on October 25, 2025. Names, dates of birth, Social Security numbers, and other identifiers sat behind an application programming interface that did not check whether a requested file belonged to the dealer who was asking. That is not a smashed server. It is a missing ID check. (700Credit settlement site)

A partner key, then ninety minutes

Attackers started at a smaller shop that handled finance work for independent dealers and talked to 700Credit every day. They read that vendor’s logs, stole API credentials and a decryption key, and impersonated a real client. The partner did not warn 700Credit. Ken Hill, 700Credit’s managing director, later said the sentence the industry did not want on a recording: “We weren’t validating the consumer reference IDs to the original requestor.” Anyone holding the stolen partner keys could throw guessed IDs at the API and pull files that belonged to some other lot.

On October 25 the crew ran what Hill described as a velocity attack for about 90 minutes before 700Credit killed the integration. He said they scraped about 20 percent of the consumer records collected between May and October. No one had to plant malware on an internal rack. The damage was the application layer plus a partner that already held a legitimate decryption key. Social Security numbers left a credit shop without a burned server room. (American Banker)

A listing, a docket, and a hearing that moved up

Hill described “heated conversations” about whether to pay the attackers. He would not confirm a payment and said the company was proceeding as if the data had been contained. On November 16, 2025, a handle calling itself ROOTBOY advertised about 8.4 million 700Credit records. The gap between 5.8 million noticed consumers and 8.4 million advertised rows is a reason not to treat a criminal’s storefront as a census. It is also a reason not to treat “contained” as a word that puts copies back in the bottle.

The first class complaint landed November 24, 2025. On February 10, 2026, the cases were consolidated in Detroit as In re 700 Credit Data Security Incident Litigation, No. 2:25-cv-13747. Judge White granted preliminary approval on June 4, 2026, and at that moment the final hearing sat on December 15. The parties then asked to pull it forward. A stipulated order reset the hearing to October 7, 2026, at 2 p.m., in Courtroom 111 of the Theodore Levin U.S. Courthouse at 231 West Lafayette Boulevard. The notice says the date and time can change without a fresh postcard. 700Credit admits no wrongdoing. (Justia, ClassAction.org)

What $17.5 million was offering, and who can still get it

Class members who received an email or a postcard in July or August 2026 could choose reimbursement of documented ordinary losses up to $2,500, or an alternative cash payment of $50. Both figures can shrink if the claim pile is large, and the flat payment can move on a pro rata basis. Expenses described in the settlement materials include bank fees, postage, local travel tied to cleaning up the mess, and money already spent on credit reports, monitoring, or identity-theft products. Two years of credit monitoring was the automatic track. Activation codes went out with the notices and do not work until the judge signs.

Doing nothing still binds a class member who did not opt out by September 8. Doing nothing also leaves the cash on the table. Seventeen and a half million dollars divided by 5.8 million Social Security numbers was never a lottery ticket. It was a claims process with a short fuse, and the fuse has burned. People who filed keep their place in line for whatever the court approves. People who meant to file and did not are in the release without the payment. The settlement site still tells visitors to be patient. Patience, after the 22nd, is about the hearing, not about a form that will reopen on its own. (Top Class Actions)

Dealers got a paperwork courtesy. Buyers got a letter.

Auto dealers are financial institutions under the FTC Safeguards Rule. A breach at one shared vendor would have forced thousands of duplicate federal filings. The National Automobile Dealers Association worked with 700Credit and the FTC on a consolidated notice so each lot would not file the same incident. Dealers still had to follow state consumer-notice laws. 700Credit mailed letters and offered Cyberscout monitoring in the first wave. The federal courtesy did not end the pressure. The FTC sent warning letters to 97 dealerships in March 2026. Michigan Attorney General Dana Nessel, with about 160,000 residents inside the blast radius, told people not to ignore the letter. South Carolina counted 108,829 residents. At least ten attorneys general received notice. A one-time pass on duplicate forms is not a finding that the lots ran a clean vendor program.

Anyone who applied for financing through a 700Credit dealer between May and October 2025 should treat the identifiers as exposed whether or not a claim went in. A freeze at Equifax, Experian, and TransUnion does not depend on Judge White’s signature. A dark-web listing is not a rumor simply because the company hoped the copy had been contained. The notice that looked like spam in July was the ticket. A lot of those notices are now in deleted mail.

The hole was a validation step

Car lots did not build 700Dealer.com. Buyers did not choose 700Credit. A finance office chose a pipeline, the pipeline trusted a smaller partner, and the smaller partner kept logs and a key that turned into a skeleton key. That chain is the pattern The AEGIS Alliance keeps hitting on this beat. The analytics leak that spilled Pornhub Premium account data is a different brand and the same geometry: the name on the homepage is only as strong as the vendor nobody has heard of. The Tricolor auto-lender collapse is the other half of the lot, the credit file and the loan tape in the same neighborhood. The IRS-impostor remote-access wave and the Phantom Hacker bank drains are what a circulated Social Security number is worth to the next crew. More of that reporting is under Hacker News.

Hill’s line about reference IDs should outlive the settlement PDF. Authentication that stops at “this partner knows the password” is not authentication of the customer. It is authentication of a stolen badge. Guessable consumer IDs plus a decryption key the partner was trusted to hold is a design that fails in one afternoon, which is approximately how long this one took.

The date that still matters

September 8 has passed: exclusion and objections. September 22 has passed: claims. October 7, 2026, at 2 p.m. is the hearing that decides whether $17.5 million, the monitoring codes, and the release become real. Attorneys’ fees, costs, and service awards are on that same agenda. 700Credit still denies wrongdoing. ROOTBOY’s row count is not a court exhibit that has to be true. It is a reminder that once a credit file is copied, the copy does not come back because a claims portal closed.

The AEGIS Alliance is not a claims mill, and this page is not a promise that a late envelope will be opened. The story from here is whether a federal judge in Detroit accepts a deal that prices 5.8 million exposed auto-finance files at $17.5 million, and whether the industry treats Hill’s admission as a bug that got patched or as the way dealer credit pipes still work. The October hearing can buy the company peace. It cannot put the reference IDs back inside the API.