Industrial Acceptance Corporation data breach: files taken in 2025, letters 458 days later

What happened at Industrial Acceptance Corporation?

On February 24, 2025, IAC became aware of unauthorized activity in its network. It says it took its systems offline until it could restore operations safely, and worked with cybersecurity specialists on the investigation and the clean-up. It also reported the event to federal law enforcement.

About a week later, on or around March 4, 2025, the company learned that files had been taken. It then reviewed those files to find out whether they held personal information and whose. The review was completed on May 11, 2026. The letter does not say how the actor got in, does not mention ransomware or a group, and does not say what the files were for. It says the company has no evidence that anyone's information has been misused.

Date	What happened	Source
February 22, 2025	Breach date in California's and Washington's records	California and Washington records
February 24, 2025	IAC becomes aware of unauthorized activity; systems taken offline; breach date in Indiana's record	Letter; Indiana record
On or around March 4, 2025	IAC learns files were taken	Letter
May 11, 2026	Review of the files completed	Letter
May 28, 2026	Letter date; notice sent, per Indiana	Letter; Indiana record
May 29, 2026	Texas publishes the report	Texas record
June 1, 2026	Reported to Washington	Washington record

The records disagree by two days on when it began. California gives February 22, 2025 as the date of the breach, and so does Washington. Indiana gives February 24, the day the letter says IAC became aware.

The 14-month review is the long part of the gap. Between learning that files were taken and finishing the review, 433 days passed; the letters followed 17 days after that. The guide to how long companies take to notify measures the same gap for other California filings in this log.

What information was in the Industrial Acceptance Corporation breach?

The filed sample leaves the list blank: its "What Information Was Involved?" section stops after "The information involved". The state records fill it in.

Washington's record lists name, Social Security number and full date of birth for 679 Washington residents. Texas's record lists Social Security numbers and driver's licence numbers.

Data type	Washington record	Texas record
Name	Yes	Not listed
Social Security number	Yes	Yes
Date of birth	Yes	Not listed
Driver's licence number	Not listed	Yes

Each state lists what was in its own residents' files, so the two lists can differ. Each letter as mailed lists that person's own items.

How many people were affected by the Industrial Acceptance Corporation breach?

Indiana gives the only total: 79,216 people.

Record	People counted
Indiana attorney general, total	79,216
Texas residents	2,706
Washington residents	679
Indiana residents	334

Texas published its report on May 29, 2026, the day after the letter date. The ranking of 2026 breaches by people affected shows where the Indiana total falls. The Texas ranking and the Washington ranking compare the state counts.

What is Industrial Acceptance Corporation offering?

Twelve months of credit monitoring and identity protection through Cyberscout, a TransUnion company, at no cost. Enrolment was at bfs.cyberscout.com/activate with the code in the letter, within 90 days of the letter date. Counting from May 28, 2026, that window closed in late August 2026. The guide to credit-monitoring offers compares this offer with others in this log.

Item	Detail from the letter
Provider	Cyberscout (TransUnion)
Length	12 months
Enrol by	Within 90 days of May 28, 2026
Help line	1-844-593-8423, Monday to Friday, 8 a.m. to 8 p.m. Eastern Time, for 90 days

Was my information in the Industrial Acceptance Corporation data breach?

If you received a letter from Industrial Acceptance Corporation dated May 28, 2026, from a return processing center in Milwaukee, Wisconsin, your information was in the taken files. The assistance line was 1-844-593-8423, Monday to Friday, 8 a.m. to 8 p.m. Eastern Time, with staff available for 90 days from the letter date. With a Social Security number in the files and the monitoring window closed, the letter's own advice still applies: check credit reports and account statements for activity you do not recognise. A free credit report is available from each of the three bureaus at annualcreditreport.com.

The guide to bank, brokerage and mortgage breach notices covers how other financial firms in this log describe their incidents.

What the notice leaves open

• How the unauthorized actor got into the network.
• What the taken files were, and what business relationship each reader had with IAC.
• Why the records give February 22 and the letter February 24.
• What each person lost; the sample leaves the list blank.