Mavis Tire data breach letter: intrusion found June 18, 2025, letters filed November 3, 2026

Date	Event
June 18, 2025	Mavis becomes aware of unauthorized access in its IT environment
After June 18, 2025	A forensics firm finds a criminal third party copied data; Mavis reviews the copied data
November 3, 2026	Sample letter filed in Massachusetts (1,433 residents); Vermont logs 85

What happened at Mavis Tire?

The letter says Mavis brought in counsel and an independent forensics firm once it learned of the access, and that the investigation found the intruder had copied data. Mavis then reviewed the copied data to find personal information, and the recipient's information turned up in that review. The company says it shut the intruder out and does not believe any risk to its systems remains. The letter does not name the attacker or say whether ransomware was used. It says Mavis is not aware of any misuse of the information.

What information was exposed in the Mavis Tire breach?

The filed letter leaves the data elements as a field filled in per person, so your own letter is the only record of what was found about you. The two state records describe the notice as a whole. Massachusetts marks Social Security numbers, medical records, financial account numbers, driver's licenses and credit or debit card numbers as involved. Vermont lists Social Security numbers, government ID numbers, financial account codes, credit and debit account information, and health records. Massachusetts files Mavis as a retail organization; neither record says whether the health records were customers' or employees'.

Record	Residents	Data marked as involved
Massachusetts OCABR, report 2026-1921	1,433	SSN, medical records, financial account, driver's license, credit/debit numbers
Vermont Attorney General	85	SSN, government ID, financial account codes, credit and debit account info, health records

What is Mavis offering, and how do I enroll?

Identity monitoring through Kroll for 24 months at no cost, covering credit monitoring, fraud consultation and identity restoration. You activate it yourself at enroll.krollmonitoring.com with the membership number printed on your letter, before the activation deadline the letter gives. Questions go to (844) 301-0180, Monday through Friday, 9:00 a.m. to 6:30 p.m. Eastern. Credit monitoring offers in breach letters compares Kroll's package with the others in the log.

Is a letter from Mavis Tire real?

The filed sample is signed "Mavis Tire", arrives by mail, and asks you to activate monitoring yourself; it does not ask you to send anything back. Compare a letter or an email against those details, and type the Kroll address into your browser rather than following a link. The letter's own advice is to check account statements and pull free credit reports, which you can order at annualcreditreport.com or by calling 1-877-322-8228.

Should I place a fraud alert or a credit freeze?

The letter describes both. A fraud alert asks lenders to verify your identity before opening an account, and the letter recommends placing it after you activate the monitoring. One bureau is enough: the one you contact passes the alert to the other two.

Why did notice take more than 16 months?

The letter does not say. It describes a review of the copied data to find whose information it held, which is the usual reason given for long gaps, but it gives no date for when that review ended. The gap from discovery to the Massachusetts filing is 503 days. How long companies take to notify after a breach sets gaps like this one against the rest of the record, and the largest breaches affecting Massachusetts residents in 2026 ranks the state's report. Other retail notices are on the consumer and retail hub.