Credit Acceptance investigates data breach impacting customer records

Michigan-based financial services provider Credit Acceptance Corp. announced that a data security incident discovered earlier this year resulted in the compromise of sensitive personal information belonging to its customers.

 

Headquartered in Southfield, Michigan, Credit Acceptance Corp. is a specialty finance company that provides indirect auto financing to consumers with limited or impaired credit histories. The company partners with automobile dealerships across the United States to facilitate vehicle financing for customers who may not qualify for traditional auto loans. 

 

In a data security incident notice filed with the Office of Massachusetts Attorney General, Credit Acceptance said that it recently identified unauthorised access to its internal network. The financial service provider immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

It also took steps to secure the affected systems and notified relevant law enforcement authorities about the incident.

 

“Credit Acceptance is writing to inform you that on June 4, 2026, we determined that certain personal information of yours was impacted by this incident,” Credit Acceptance said.

 

The compromised information included individuals’ names and other personal identifiers including Social Security numbers. Credit Acceptance is yet to share the number of affected individuals.

The specialty finance company has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general. 

 

It has also offered two years of complimentary identity protection and credit monitoring services through Kroll to all affected individuals.

 

At the time of publishing, no known hacker group claimed responsibility for the cyber attack on Credit Acceptance. The finance company also did not share details on who was behind the attack, how much data was compromised, or whether it had received a ransom demand.