Edmunds.com Vendor Data Breach Exposes Social Security Numbers

On Aug. 19, 2025, Edmunds.com experienced a data breach involving its proprietary messaging tool. This tool is used by automobile dealers and potential customers to communicate, storing mobile text messages exchanged between the parties.

According to a notice filed with the Montana Attorney General, the breach was traced to unauthorized activity detected by a vendor operating systems that support this messaging tool.

Upon investigation, it was determined that seventeen text messages may have been accessed by the unauthorized party. These messages contained a combination of personally identifiable information, including names, Social Security numbers, credit card information and driver’s license information.

The breach was first disclosed to state authorities on Nov. 14, 2025.

Edmunds.com's response

For those affected, Edmunds has arranged for 24 months of complimentary credit monitoring and identity protection services through IDX. These services include single-bureau credit monitoring, CyberScan dark web monitoring, a $1 million identity theft insurance reimbursement policy and fully managed identity theft recovery services. Impacted individuals are encouraged to enroll in these services by Jan. 31, 2026, to take full advantage of the protection offered.

Given the nature of the breach, Edmunds recommends that all affected individuals remain vigilant by regularly reviewing their credit reports, financial accounts and insurance statements for any suspicious activity. They should promptly report any signs of fraud to the appropriate financial institution or law enforcement authority.

The company has also provided detailed guidance in the consumer notice about placing fraud alerts or security freezes on credit files, as well as information on accessing free credit reports.