Mavis Tire Supply 2025 Data Breach
ObscureIQ Breach Intelligence
High SeverityWebsite / service breach
Mavis Tire Service Chain Breach (2025): 24 Million Customer Records Including SSN, License Plate & VIN Exposed
Automotive tire sales and service chain.
Verified by ObscureIQ Intelligence
73/100Breach Risk Index
35Data Value
40Market Recency
269dSince Breach
Breach Intelligence Summary
Entity: Mavis Tire Supply · Actor: WorldLeaks · Sources: 2 references
Attack: Ransomware / Extortion
Profile: Company · Automotive services and tire retail · Service center network · USA
Timeline: Breach (2025-09-23) · Indexed (Oct 12, 2025) · Year (2025)
Exposure: 24.3M records · 8 fields: Date of Birth, Email Address, Full Name, Phone Number, Physical Address, Social Security Number, Vehicle Plate, Vehicle VIN
Status: Confirmed
Executive Summary
Mavis Discount Tire, one of the largest independent tire and automotive service retailers in the United States, was hit by a ransomware attack carried out by WorldLeaks, a financially motivated group that emerged in 2025 as a rebrand of the Hunters International operation. Systems disruption was first detected on September 23, 2025, though the estimated attack date is May 27, 2025, suggesting the intrusion went undetected for months. Stolen data was confirmed circulating on dark web forums by October 7, 2025. The breach affects an estimated 24.3 million records across Mavis's network of more than 700 service centers in 13 states. The exposed data includes names, Social Security numbers, dates of birth, home and street addresses, email addresses, phone numbers, vehicle identification numbers (VINs), and license plate numbers. Social Security numbers are especially unexpected from an automotive service retailer and represent the highest individual risk in this dataset. The combination of VINs and license plates is also notable: together, they can enable vehicle title fraud and allow bad actors to physically identify and locate a specific person's car. Affected individuals face heightened risks of identity theft, financial fraud, and vehicle-linked targeting. A class-action lawsuit, Bunch v. Mavis Tire Supply LLC, was filed on October 22, 2025, alleging cybersecurity negligence and a failure to protect customer data. Mavis has not made detailed public statements about the breach's scope or its notification timeline. People whose data was exposed should monitor their credit, place fraud alerts with credit bureaus, and be alert to phishing attempts, impersonation scams, or unexpected contact referencing their vehicle or service history.
ObscureIQ assessment: Main risks include phishing, payment fraud, service-center impersonation, and vehicle-linked social engineering. Service history and contact data can also support household targeting.
Breach Impact
The WorldLeaks ransomware group, a financially motivated operation that emerged in 2025 as a rebrand of the Hunters International operation, claimed responsibility for the attack. Systems disruption was first detected on September 23, 2025, with stolen data confirmed posted to dark web forums on October 7. The leaked dataset included customer identity data, home addresses linked to service accounts, and employee records — with SSNs appearing to relate primarily to employee data rather than customer accounts. A class-action lawsuit, Bunch v. Mavis Tire Supply LLC, was filed on October 22, 2025, alleging cybersecurity negligence and contractual failures to safeguard customer data. Mavis has not made detailed public statements about the scope of the breach or its notification process.
About Mavis Tire Supply
Mavis Tire Supply LLC, operating as Mavis Discount Tire, is one of the largest independent multi-brand tire and automotive service retailers in the United States. Founded in 1972 and headquartered in New York, the company operates more than 700 service centers across 13 states, concentrated in the Northeast and South. It offers tire sales, brake service, oil changes, wheel alignment, and general vehicle maintenance.
Why They Hold Your Data
Automotive service networks collect customer names, phone numbers, emails, physical addresses, appointment records, service history, and payment-related data tied to vehicle maintenance and retail transactions.
Recent Developments
Mavis Tire Supply operates as a privately held company with limited public financial reporting. No major organizational changes or leadership announcements have been prominently documented in public sources in the 12-18 months prior to the breach.
Data Points Exposed
8 verified field types
Date of Birth High
Email Address
Full Name High
Phone Number
Physical Address High
Social Security Number Critical
Vehicle Plate
Vehicle VIN
Field names are shown in full for clarity and search visibility. Canonical machine keys are emitted only in this page’s structured data.
Exploitation & Downstream Threats
Threat Activity:Critical
Primary downstream threats:
- Identity theft and synthetic identity construction using government-issued IDs
- Identity verification bypass using name + date of birth combination
- SIM swap attacks where phone numbers are present
- Targeted phishing campaigns using exposed email addresses
- Doxxing risk from physical address exposure
Threat vectors:
- Identity verification bypass
- Phishing, credential stuffing & account takeover
- Name-based social engineering
- SIM swapping, vishing & SMS phishing
- Physical stalking, mail fraud & identity verification
- Home targeting, stalking & physical threat
- Geolocation & property fraud
- Full identity theft & synthetic identity fraud
- Fraudulent toll evasion, title fraud & physical tracking
- Title washing & vehicle fraud
Threat Actor: WorldLeaks
WorldLeaks
Ransomware / Extortion
Attribution and method are based on available breach intelligence. Reported attack vector: Ransomware / Extortion.
Recommended Actions
If you believe your information may be included:
Protect Your ID Documents
Government-ID exposure enables document fraud — monitor and report misuse.
Enable MFA Everywhere
Turn on multi-factor authentication on email first, then financial accounts.
Report & Recover
If you spot misuse, start an official recovery plan and report fraud.
Frequently Asked Questions
What happened in the Mavis Tire Supply breach?▾
Mavis Discount Tire, one of the largest independent tire and automotive service retailers in the United States, was hit by a ransomware attack carried out by WorldLeaks, a financially motivated group that emerged in 2025 as a rebrand of the Hunters International operation. Systems disruption was…
What data was exposed?▾
Verified fields include Date of Birth, Email Address, Full Name, Phone Number, Physical Address, Social Security Number, Vehicle Plate, Vehicle VIN.
What should I do if I was affected?▾
Change reused passwords, enable MFA, and (if identity or financial data is involved) freeze your credit and monitor your accounts.
Sources & References
Every claim on this page is traceable. This breach draws on:
Breach Index
ObscureIQ Intelligence
ObscureIQ proprietary analysis
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation