Challenge Financial Services Breach Exposes Personal Info Including SSNs

Challenge Financial Services, an indirect auto finance company headquartered in Orange, California, disclosed a data breach that occurred in August 2026.

The breach was reported to the California Attorney General. Challenge Financial Services also posted a notice on its website.

An unauthorized third party gained access to the company's environment on Aug. 17, 2026, and maintained that access through Aug. 18, 2026.

On Aug. 31, 2026, the company discovered the unauthorized access, secured its network and launched an investigation into the incident. On the same day, a ransomware group known as SETTRA posted a claim on the dark web using the Tor network. The group stated it had obtained 173 GB of the organization's data and intended to publish the stolen information within 10 to 11 days.

Challenge Financial Services' investigation determined that certain files containing customer personal information may have been viewed or taken during the two-day window of unauthorized access.

The types of personal information exposed in the breach included names, Social Security numbers, addresses and dates of birth.

Challenge Financial Services' response to the breach

Challenge Financial Services is offering affected individuals 12 months of complimentary credit monitoring and identity restoration services through IdentityIQ.

To enroll in the free monitoring services, affected individuals should visit the company's dedicated enrollment page. From there, they can log in using their existing Challenge Financial credentials or register a new account and then complete the IdentityIQ enrollment and identity verification process. The deadline to enroll is Dec. 15, 2026.

The company has set up a dedicated toll-free assistance line for questions about the breach at 866-344-7630, available Monday through Friday from 8:30 a.m. to 5:30 p.m. Pacific Time. Individuals may also send written inquiries to Challenge Financial Services, Attn: Data Incident, 1004 W Taft Ave., Suite 100, Orange, CA 92865.

For questions about the IdentityIQ monitoring service, individuals can contact IDIQ's customer service team at 877-875-4347, available Monday through Friday from 5:00 a.m. to 4:00 p.m. PT and Saturdays from 6:30 a.m. to 3:00 p.m. PT.