Yorozu Automotive Data Breach Affects 20,627 Individuals: PHI and PII Exposed

Yorozu Automotive Tennessee Inc., a U.S. manufacturing subsidiary of Japan-based Yorozu Corporation, disclosed a data breach that has affected 20,627 individuals in the United States, including 22 Indiana residents, eight Massachusetts residents and one Vermont resident.

The incident took place on Oct. 9, 2024. The range of exposed information was extensive and spanned several sensitive categories.

The personally identifiable information (PII) compromised in the breach included full names, home addresses, dates of birth, Social Security numbers, Social Security cards, driver's license numbers, government-issued identification cards and other government identification numbers, financial information, including credit and debit card numbers, financial account information and financial account access codes, employment-related documents, including W-2 tax forms and pay stubs.

In addition, the breach exposed protected health information (PHI) including health records and medical records.

The company began notifying affected individuals on June 2, 2026.

Yorozu Automotive Tennessee's response to the breach

The company is offering 24 months of free identity theft protection services through IDX. The services include credit monitoring, CyberScan monitoring, a $1,000,000 insurance reimbursement policy and fully managed identity theft recovery services.

Affected individuals can enroll in the IDX protection services by visiting the IDX enrollment page and entering the unique enrollment code included in their notification letter. The deadline to enroll is Sept. 2, 2026. IDX representatives are available Monday through Friday from 9 a.m. to 9 p.m. Eastern Time to answer questions about enrollment and the available services.

The company also established a dedicated assistance line for people affected by the breach. The line is available Monday through Friday from 9 a.m. to 9 p.m. Eastern Time, excluding holidays. The phone number was included in each individual's notification letter, and callers should reference the Yorozu incident when contacting the line.