On November 16, 2022, AAA Collections, Inc. reported a data breach with the Montana Attorney General’s Office after the company learned that an unauthorized party was able to access sensitive consumer data contained on its computer system. As of today, AAA Collections has not published notice of the breach on its website or otherwise clarified what information was compromised. However, based on state data breach reporting requirements, it is likely that the incident involved consumers’ names and one or more of the following: Social Security numbers, financial account information, government identification numbers or protected health information. Recently, AAA Collections sent out data breach letters to all affected parties, informing them of the incident and what they can do to protect themselves from identity theft and other frauds.
What We Know About the AAA Collections Data Breach
The available information regarding the AAA Collections breach comes from the company’s filing with the Attorney General of Montana. According to this source, on September 7, 2022, AAA Collections detected a security incident related to its computer system. While the company does not elaborate on what led to this discovery, in response, AAA Collections launched an investigation to determine the scope of the incident as well as whether any consumer information was jeopardized as a result.
The AAA Collections investigation confirmed that an unauthorized party gained access to the company’s computer system on September 5, 2022, and continued to have access until September 7, 2022. The investigation also revealed that the unauthorized party copied some of the data, which included sensitive information belonging to consumers.
Upon discovering that sensitive consumer data was made available to an unauthorized party, AAA Collections began to review the affected files to determine what information was compromised and which consumers were impacted. This process was completed on October 24, 2022; however, AAA Collections has not yet posted notice of the breach on its website, and the company’s data breach letter does not specify what data types were leaked. But looking at the Montana data breach requirements, only companies that experience a leak involving consumers’ names and one or more of the following are required to report a breach:
Based on AAA Collections’ business model, it would seem that the most likely data types were Social Security numbers and financial account information, although this cannot be confirmed at this point.
On November 16, 2022, AAA Collections sent out data breach letters to all individuals whose information was compromised as a result of the recent data security incident.
More Information About AAA Collections, Inc.
Founded in 1965, AAA Collections, Inc., which also goes by the name Advanced Asset Alliance, Inc., is a collection of accounts receivable management companies based in Sioux Falls, South Dakota. The company helps its corporate and business clients recover outstanding accounts receivable through various collections procedures. AAA Collections employs more than 54 people and generates approximately $13 million in annual revenue.
If you received a data breach notification, it is essential you understand what is at risk and what you can do about it. To learn more about how to protect yourself from becoming a victim of fraud or identity theft and what your legal options are in the wake of the AAA Collections data breach, please see our recent piece on the topic here.
