On June 4, the U.S. District Court for the Eastern District of Michigan granted preliminary approval of a $17.5 million proposed class action settlement in litigation arising from an alleged “data security incident” discovered on or around October 25, 2025. The settlement agreement states that the alleged incident involved unauthorized access to or acquisition of private information after cybercriminals allegedly used compromised credentials to access the web application of the defendant, a credit-reporting and identity-verification services provider for vehicle dealerships. The private information allegedly affected included some combination of names, addresses, dates of birth and Social Security numbers, and class counsel stated that the incident potentially affected approximately 5.8 million individuals.

The court provisionally certified, for settlement purposes only, a class of all living U.S. residents who were sent notice that their private information may have been affected by the incident, excluding certain categories of persons and entities. The settlement provides for a non-reversionary $17.5 million fund and allows class members to submit claims for either up to $2,500 in documented losses related to fraud or identity theft or an estimated $50 alternate cash payment, subject to pro rata adjustment. Class members also will receive two years of credit monitoring without submitting a claim form, and the settlement notice states that the defendant implemented additional security measures following the incident.

The court approved the notice program and appointed a settlement administrator to handle notice and claims administration. The court scheduled a final approval hearing for December 15, where it will consider final certification, final approval, dismissal with prejudice of the various claims, releases binding class members, and awards for attorneys’ fees, costs, and service. The defendant entered into the settlement without admitting liability or wrongdoing.