TMX Finance (TMX), along with a portion of its subsidiaries, collectively disclosed a data breach following a cyberattack that was discovered on February 13, 2023, after suspicious activity was observed. TMX’s impacted subsidiaries consist of TitleMax (a leading car title loan company in the United States), TitleBucks (a company specializing in car title-secured loans or pawns as well as in-store or online personal loans), and InstaLoan (a fast-approval personal loan service). An investigation into this activity concluded that an unauthorized third-party gained access to TMX systems on December 10, 2022, and data of approximately 4.8 million individuals was exfiltrated between February 3 and February 14, 2023. The company’s data breach notice explains that the exfiltrated data includes names, dates of birth, passport numbers, driver’s license numbers, federal/state identification card numbers, tax identification numbers, Social Security numbers (SSNs), financial account information, and additional data such as phone numbers, email addresses, and physical addresses. The actor responsible for the cyberattack and data breach of TMX has yet to claim responsibility, and TMX has not publicly attributed the attack to a specific threat group as of April 4, 2023. CTIX will continue to monitor the TMX Finance data breach and provide updates when available.