General Motors (GM) disclosed a data breach following a credential stuffing attack that occurred in April 2022. A credential stuffing attack is an attack conducted through collections of username and password combinations previously leaked in other sites’ data breaches to gain access to user accounts on a targeted website. GM revealed in their notification letter, sent out to impacted individuals on May 16, 2022, that suspicious login activity occurred between April 11 and April 29, 2022. The manufacturer confirmed that there is currently no evidence that the login credentials were obtained from GM itself and that the unauthorized threat actors behind the compromise may have gained access to limited personal information, such as “first and last name, personal email address, personal address, username and phone number for registered family members tied to [the] account, last known and saved favorite location information, your currently subscribed OnStar package (if applicable), family members’ avatars and photos (if uploaded), profile picture, search and destination information, reward card activity, and fraudulently redeemed reward points.” GM emphasized that individuals’ dates of birth, Social Security numbers, driver’s license numbers, and credit card or bank account information were not impacted by this unauthorized access, as the information is not stored in user accounts. There are approximately 4,900 individuals impacted by General Motors’ data breach. CTIX analysts will continue to monitor for credential stuffing attacks and recommend that multi-factor authentication (MFA) is implemented to mitigate this risk.