Mavis Tire Service Chain Breach (2025): 24 Million Customer Records Including SSN, License Plate & VIN Exposed

About Mavis Tire Supply

Mavis Tire Supply LLC, operating as Mavis Discount Tire, is one of the largest independent multi-brand tire and automotive service retailers in the United States. Founded in 1972 and headquartered in New York, the company operates more than 700 service centers across 13 states, concentrated in the Northeast and South. It offers tire sales, brake service, oil changes, wheel alignment, and general vehicle maintenance.

Why They Hold Your Data

Automotive service networks collect customer names, phone numbers, emails, physical addresses, appointment records, service history, and payment-related data tied to vehicle maintenance and retail transactions.

Recent Developments

Mavis Tire Supply operates as a privately held company with limited public financial reporting. No major organizational changes or leadership announcements have been prominently documented in public sources in the 12-18 months prior to the breach.

Data Points Exposed

Breach Impact

The WorldLeaks ransomware group, a financially motivated operation that emerged in 2025 as a rebrand of the Hunters International operation, claimed responsibility for the attack. Systems disruption was first detected on September 23, 2025, with stolen data confirmed posted to dark web forums on October 7. The leaked dataset included customer identity data, home addresses linked to service accounts, and employee records — with SSNs appearing to relate primarily to employee data rather than customer accounts. A class-action lawsuit, Bunch v. Mavis Tire Supply LLC, was filed on October 22, 2025, alleging cybersecurity negligence and contractual failures to safeguard customer data. Mavis has not made detailed public statements about the scope of the breach or its notification process.

Exploitation & Downstream Threats

• Identity theft and synthetic identity construction using government-issued IDs | • Identity verification bypass using name + date of birth combination | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure

What You Should Do

1. Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
2. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
3. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
4. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).