Yes, TitleMax did send customers letters warning of a data breach

A VERIFY reader received a letter appearing to be from TitleMax, a car title and personal loan company, warning them of a data breach. They wanted to know if the letter is real or a scam, and if there might be a class action lawsuit related to it.

THE QUESTION

Did TitleMax send out a letter warning customers of a data breach?

THE SOURCES

• TMX Finance, the parent company of TitleMax, TitleBucks and InstaLoan
• Office of the Maine Attorney General
• ClassAction.org, an online information resource about class action lawsuits
• Class action complaint against TMX Finance

THE ANSWER

Yes, TitleMax did send out a letter warning customers of a data breach.

WHAT WE FOUND

TMX Finance, the parent company of TitleMax, TitleBucks and InstaLoan, sent all potentially affected people a notification letter or email warning them that their data may have been compromised in a recent data breach, according to an alert on the TitleMax website.

The company says it detected “suspicious activity” in its systems on Feb. 13. An investigation revealed the breach first occurred on Dec. 10, 2022. TMX reported the breach to consumers on March 30, 2023, according to the report TMX submitted to the Office of the Maine Attorney General.

TMX’s report to the Maine Attorney General says the breached data contained personal information for 4.8 million people.

The compromised information includes:

• Names
• Dates of Birth
• Social Security numbers
• Passport numbers
• Driver's license numbers
• Federal/state identification card numbers
• Tax identification numbers
• Financial account information
• Addresses
• Phone numbers
• Email addresses

Although TMX believes the breach has been contained, it’s continuing to monitor its systems and its investigation into the incident is still ongoing. The company has reported it to the FBI.

What should I do if I’ve received a notification letter or email?

TMX is offering affected customers an activation code for 12 months of free credit monitoring and identity protection services through Experian IdentityWorks. TMX recommends that customers enroll in this program before July 31, 2023, when the promotional codes expire. Instructions for enrolling are in the notification letter and email.

Additionally, TMX recommends you review your financial account statements and credit reports closely. Promptly notify your bank if you notice any suspicious activity on your bank account. Consider placing a fraud alert on your credit report or a security freeze on your credit file. 

A security freeze will keep creditors from accessing your credit report, which keeps them from approving any new credit account under your name, USA.gov says.

If you want to put a security freeze on your credit file, you’ll need to do it separately with each of the three main credit reporting bureaus: Equifax, Experian and TransUnion.

Is there a class action lawsuit against TMX?

Currently, TMX is the target of a class action complaint and mass arbitration, ClassAction.org, an online information resource about class action lawsuits, says.

The class action lawsuit was filed on March 31, the same day TitleMax announced the data breach. It alleges the victims’ personal information was compromised due to TMX’s “negligent and/or careless acts and omissions.” Additionally, the suit alleges that TMX failed to warn its customers they were at increased risk of identity theft and fraud by waiting more than three months after the breach first occurred to report it.

The lawsuit looks to cover all people whose information was accessed or acquired in the data breach.

Right now, there’s nothing any potential claimant has to do to participate in the lawsuit, ClassAction.org says. If the lawsuit is settled, then a claimant typically has to fill out a form and file a claim either online or through the mail in order to get their money.

However, there is no guarantee that the class action lawsuit will succeed. TitleMax’s loans come with a clause requiring borrowers to resolve any disputes with the company through arbitration, ClassAction.org says. Arbitration is a way of settling a legal dispute before a neutral arbitrator instead of a judge or jury, and comes with a different set of rules.

Because of this, some lawyers are attempting to recruit people to make mass arbitration claims. Mass arbitration is “when hundreds or thousands of consumers file individual arbitration claims against the same company over the same issue at the same time,” ClassAction.org says. The goal is similar to that of a class action lawsuit — to get the company to settle instead of paying the costly fees for arbitrating every individual claim.

To join in mass arbitration, you need to file a claim with a law firm and might need to potentially share additional information with the lawyers representing you. ClassAction.org links to the claim form for one law firm handling mass arbitration cases against TMX, and other law firms may potentially seek to represent clients in mass arbitration, as well.

It costs nothing to sign up or participate in mass arbitration with most law firms, including the one ClassAction.org is providing a claims form for; the lawyers will only be paid if you win your claim with a predetermined portion of the settlement. For this case, ClassAction.org says you could be entitled to a claim worth $200 or more.