Customers of TitleMax, TitleBucks, and Instalone are warning of a massive data breach after TMX Finance revealed that hackers gained access to its systems and stole large amounts of personal information.

As reported by BleepingComputer (opens in new tab), TMX is a public financial services company headquartered in Canada with operations in the US, UK, Canada, Australia, and China; its subsidiaries include TitleMax, TitleBucks, InstaLoan which is a lender with 1,100 locations across the U.S. TitleMax is a car title loan service, and InstaLoan is a personal loan service for people with bad credit.

According to a new data breach notification letter (opens in new tab) sent to affected customers, hackers accessed the company's systems last December, but TMX did not detect the breach until February 13, 2023.

An internal investigation by the company revealed that between February 3 and 14 of this year, hackers stole confidential personal information of its customers; TMX has a large presence in many states in the U.S. A total of 4,822,580 customers were affected by this data breach.

TMX now believes that the security incident has been contained, but the company continues to monitor its systems for signs of suspicious activity.

Unfortunately, affected customers were exposed to personal information as a result of the data breach, including full names, dates of birth, passport numbers, driver license numbers, federal/state identification card numbers, taxpayer numbers, social security numbers, financial account information, phone numbers, addresses, and e-mail addresses.

This is more than enough information to commit identity theft, and TitleMax, TitleBucks, and InstaLoan customers should be on high alert. Thankfully, TMX has no intention of leaving its customers in the lurch.

If you receive a data breach notification letter from TMX, don't rush to sign up for the best identity theft protection service yet. (But it can't hurt.)

To help customers deal with the repercussions they may experience as a result of a data breach, the company will enroll them in Experian's identity theft protection service free for 12 months. Customers may also want to request a security freeze and credit freeze through Experian.

In addition to taking advantage of this promotion, affected customers should remain vigilant and carefully check both their credit reports and account statements for fraudulent activity.

At this time, the hackers behind this massive data breach have not claimed responsibility for the attack, but TMX has notified the FBI about the incident and may learn more soon.