What Happened in the Exeter Finance Data Breach?
Exeter Finance LLC, a privately held auto finance company based in Irving, Texas, has disclosed a data breach affecting consumer personal information. The company identified a security incident that involved unauthorized exposure of certain consumer data. As a result, Exeter Finance began an internal review to understand the scope of the incident and determine which individuals were affected.
According to the company, the review process involved carefully examining the affected files to confirm what information was involved. This type of investigation typically requires forensic specialists to trace how the data was accessed and which records were touched. On June 10, 2026, Exeter Finance completed this review and confirmed that consumer personal information had indeed been compromised in the Exeter Finance data breach.
The source material does not specify the exact date the unauthorized access originally occurred, nor does it name the method of attack. However, the timeline shows that Exeter Finance took time after discovering the incident to fully investigate before notifying anyone. This is consistent with standard practice, since companies often need weeks to determine the full scope of a breach before alerting regulators and consumers.
Who was affected?
The individuals affected by this breach appear to be consumers who hold or held auto loan accounts with Exeter Finance. Because the exposed data includes Exeter auto loan account numbers, the incident likely affects current and former borrowers whose loans were serviced by the company. The exact number of affected individuals has not been publicly disclosed.
Exeter Finance reported the breach to the Massachusetts Office of Consumer Affairs and Business Regulation, which suggests at least some affected individuals reside in Massachusetts. However, since Exeter Finance operates as a national auto finance company, the breach may extend to customers across many other states as well. There is no indication in the available information about whether minors or dependents were involved.
What Information Was Potentially Exposed?
Exeter Finance confirmed that several categories of personal and financial information were exposed in this breach. The company has stated that additional categories of information beyond what is listed may also be involved, though those have not been fully detailed publicly.
- Full names
- Exeter auto loan account numbers
- Financial account information
- Other unspecified categories of personal information
Because this breach includes financial account details, affected individuals face a real risk of financial fraud. For example, criminals could use exposed loan account numbers to impersonate victims when contacting lenders or attempting to reroute payments. In addition, having a name paired with financial account information gives scammers a foundation for convincing phishing attempts.
Furthermore, this type of exposure can lead to broader identity theft concerns. Fraudsters often combine financial account data with other personal details, sometimes gathered from separate breaches, to open new lines of credit or take over existing accounts. As a result, affected individuals should treat this incident seriously, even though Social Security numbers have not been confirmed as exposed.
What is the company doing?
After identifying the incident, Exeter Finance moved to investigate the scope of the exposure and confirm which consumers were affected. Once the review concluded, the company reported the breach to the Massachusetts Office of Consumer Affairs and Business Regulation on June 26, 2026. This regulatory notification is a standard step required when consumer data has been compromised.
In addition to regulatory reporting, Exeter Finance mailed notification letters to affected consumers on June 25, 2026. The company is also offering 12 months of complimentary credit monitoring and identity theft protection through Epiq. This service, called Privacy Solutions ID 1B Credit Monitoring Plus, includes one-bureau credit monitoring with alerts, a VantageScore 3.0 credit score and report, Social Security number monitoring, dark web monitoring, and change of address monitoring.
Affected individuals can enroll in this protection by visiting Epiq’s enrollment website and entering the activation code included in their notification letter. For those who need enrollment assistance, Epiq has set up a dedicated phone line. Exeter Finance has also created its own dedicated phone line for general questions about the breach or the notification process.
What Should Affected Individuals Do?
Enroll in the Free Credit Monitoring
Because Exeter Finance is offering free credit monitoring through Epiq, affected individuals should take advantage of this benefit as soon as possible. The Privacy Solutions ID 1B Credit Monitoring Plus service includes valuable features like dark web monitoring and Social Security number monitoring, which can catch early signs of misuse.
To enroll, simply visit the Epiq enrollment website and enter the activation code from your notification letter. If you run into any issues, Epiq’s support line is available on weekdays to help walk you through the process. Acting quickly ensures you have coverage in place while the risk of misuse remains elevated.
Monitor Your Financial Accounts and Credit Reports
In addition to enrolling in the offered monitoring service, affected individuals should regularly check their own bank and loan account statements. Look closely for unfamiliar transactions or any unexpected changes to your Exeter Finance loan account. Because financial account information was exposed, this step is especially important.
You should also review your credit reports from all three major bureaus, not just the one covered by the free monitoring service. Under federal law, you can request a free credit report annually from each bureau. This means you can layer your own checks on top of the monitoring Exeter Finance is providing.
Consider a Fraud Alert or Credit Freeze
Given that financial account information and loan account numbers were involved, affected individuals should strongly consider placing a fraud alert on their credit file. A fraud alert requires lenders to take extra verification steps before opening new credit in your name. This can help stop identity thieves before they succeed.
For even stronger protection, you may want to place a full credit freeze with each of the three major credit bureaus. A credit freeze restricts access to your credit report entirely, making it much harder for anyone to open new accounts using your information. While a freeze takes a few extra steps to lift when you need credit yourself, it offers significant peace of mind.
Stay Alert to Phishing Attempts
Because your name and financial details were exposed, scammers may try to use this information to craft convincing phishing emails, texts, or phone calls. For instance, someone might pose as Exeter Finance or a related lender to trick you into revealing more sensitive information. Always be cautious with unsolicited communications referencing your loan account.
If you receive a suspicious message, avoid clicking any links or providing personal details. Instead, contact Exeter Finance directly using the dedicated phone line the company has established for this breach. This way, you can verify the legitimacy of any communication before responding.
Consult a Data Breach Attorney
If you received a notification letter from Exeter Finance, you may want to speak with an attorney who focuses on data breach cases. An attorney can help you understand whether you qualify for compensation or whether a class action related to this incident may be appropriate for your situation.
Many data breach attorneys offer free consultations, so reaching out costs nothing upfront. Because deadlines for legal claims can be limited by state law, it makes sense to act sooner rather than later if you believe you suffered harm from this exposure.
More Information
Massachusetts Office of Consumer Affairs and Business Regulation