Notice of Data Incident
Phil Smith Automotive Group ("we," "us," or "our") is posting this substitute notice to provide customers and individuals with information about the cybersecurity incident on our systems and to share resources available to people whose personal data may have been impacted.
The review of potential personal information that may have been involved in this incident is now complete. We are providing this notice to help potentially impacted individuals understand what happened, let them know what information may have been impacted, and give them information on steps they can take to protect their privacy.
This substitute notice contains the information we can provide at this time. We have identified potentially affected individuals and are mailing written letters to those individuals for whom we have a sufficient address. Please note, we may not have sufficient addresses for all affected individuals.
What Happened? We detected unauthorized activity in our information technology (IT) systems. Upon discovering this activity, we immediately took protective actions to stop the unauthorized access, notified U.S. federal law enforcement, and launched an investigation with the assistance of leading cybersecurity specialists. The investigation indicated that some of your personal information may have been accessed by an unauthorized party in early February 2025. At this time, we have no reason to believe your information has been misused; however, we are providing you notice out of an abundance of caution.
What Personal Information May Be Involved? The affected personal information may have included your name, biometric data, date of birth, driver's license or state-issued identification number, financial account information, health insurance information, medical information, passport number, Social Security number, tax identification number, and other government-issued identification number.
What We Are Doing. We are taking this incident very seriously. Upon detecting unauthorized activity in our IT systems, we took immediate protective actions to contain the activity and retained industry-leading cybersecurity specialists to investigate the incident, ensure the unauthorized access ceased, and use lessons learned to improve our systems' security posture. It is our priority to continue to evaluate and deploy the level of robust security protocols, continuous monitoring, and staff training needed to prevent and defend against sophisticated cybersecurity threats. Individuals potentially affected by this incident are being offered free credit monitoring by TransUnion. Affected individuals also are encouraged to remain vigilant and monitor their account statements, bills, notices, financial transactions, and free credit reports for potential fraud and identity theft, and to promptly report any questionable or suspicious activity. If you have questions regarding this incident or the services available to you please call the help line at 1-833-397-5381 (excluding major U.S. Holidays): Eastern Time: Monday to Friday 8:00 AM to 8:00 PM.
RECOMMENDED STEPS FOR IDENTITY THEFT PROTECTION
Review Your Credit Reports. We recommend that you remain vigilant by reviewing account statements and monitoring credit reports. Under federal law, you also are entitled every 12 months to one free copy of your credit report from each of the three major credit reporting companies. To obtain a free annual credit report, go to www.annualcreditreport.com or call 1-877-322-8228. You may wish to stagger your requests so that you receive a free report by one of the three credit bureaus every four months.
You have the right to file a police report if you experience identity fraud. Please note that in order to file a crime report or incident report with law enforcement for identity theft, you will likely need to provide some kind of proof that you have been a victim. A police report is often required to dispute fraudulent items. You can report suspected incidents of identity theft to local law enforcement or to the Attorney General's office in your home state.
Place Fraud Alerts with the three credit bureaus. If you choose to place a fraud alert, we recommend you do this after activating your credit monitoring. You can place a fraud alert at one of the three major credit bureaus by phone and also via Experian's or Equifax's website. A fraud alert tells creditors to follow certain procedures, including contacting you, before they open new accounts or change your existing accounts. For that reason, placing a fraud alert can protect you, but also may delay you when you seek to obtain credit. The contact information for all three bureaus is as follows:
Credit Bureaus |
| |
Equifax Fraud Reporting | Experian Fraud Reporting
| TransUnion Fraud Reporting |
It is necessary to contact only ONE of these bureaus and use only ONE of these methods. As soon as one of the three bureaus confirms your fraud alert, the others are notified to place alerts on their records as well. You will receive confirmation letters in the mail and will then be able to order all three credit reports, free of charge, for your review. An initial fraud alert will last for one year.
Please Note: No one is allowed to place a fraud alert on your credit report except you.
Security Freeze. By placing a security freeze, someone who fraudulently acquires your personally identifiable information will not be able to use that information to open new accounts or borrow money in your name. You will need to contact the three national credit reporting bureaus listed above to place the freeze. Keep in mind that when you place the freeze, you will not be able to borrow money, obtain instant credit, or get a new credit card until you temporarily lift or permanently remove the freeze. There is no cost to freeze or unfreeze your credit files.
You can obtain additional information about the steps you can take to avoid identity theft from the following agencies. The Federal Trade Commission (FTC) also encourages those who discover that their information has been misused to file a complaint with them.
California Residents: Visit the California Office of Privacy Protection (www.oag.ca.gov/privacy) for additional information on protection against identity theft.
District of Columbia Residents: Office of the Attorney General for the District of Columbia, Office of Consumer Protection, at 400 6th St. NW, Washington, D.C. 20001, https://oag.dc.gov, or by phone at (202) 442-9828.
Kentucky Residents: Office of the Attorney General of Kentucky, 700 Capitol Avenue, Suite 118 Frankfort, Kentucky 40601, www.ag.ky.gov, Telephone: 1-502-696-5300.
Maryland Residents: Office of the Attorney General of Maryland, Consumer Protection Division Office, 44 North Potomac Street, Suite 104, Hagerstown, MD 21740, Telephone: 1-888-743-0023, or at https://www.marylandattorneygeneral.gov/Pages/contactus.aspx
Massachusetts Residents: You are advised of your right to obtain a police report in connection with this incident.
New Mexico Residents: You have rights pursuant to the Fair Credit Reporting Act, such as the right to be told if information in your credit file has been used against you, the right to know what is in your credit file, the right to ask for your credit score, and the right to dispute incomplete or inaccurate information. Further, pursuant to the Fair Credit Reporting Act, the consumer reporting agencies must correct or delete inaccurate, incomplete, or unverifiable information; consumer reporting agencies may not report outdated negative information; access to your file is limited; you must give your consent for credit reports to be provided to employers; you may limit "prescreened" offers of credit and insurance you get based on information in your credit report; and you may seek damages from a violator. You may have additional rights under the Fair Credit Reporting Act not summarized here. Identity theft victims and active duty military personnel have specific additional rights pursuant to the Fair Credit Reporting Act. You can review your rights pursuant to the Fair Credit Reporting Act by visiting www.consumerfinance.gov/f/201504_cfpb_summary_your-rights-under-fcra.pdf, or by writing Consumer Response Center, Room 130-A, Federal Trade Commission, 600 Pennsylvania Ave. N.W., Washington, D.C. 20580.
New York Residents: the Attorney General may be contacted at: Office of the Attorney General, The Capitol, Albany, NY 12224-0341; 1-800-771-7755; https://ag.ny.gov/.
North Carolina Residents: Office of the Attorney General of North Carolina, 9001 Mail Service Center Raleigh, NC 27699-9001, www.ncdoj.gov, Telephone: 1-919-716-6400.
Oregon Residents: Oregon Department of Justice, 1162 Court Street NE, Salem, OR 97301-4096, www.doj.state.or.us/, Telephone: 877-877-9392
Rhode Island Residents: Office of the Attorney General, 150 South Main Street, Providence, Rhode Island 02903, www.riag.ri.gov, Telephone: 401-274-4400
All US Residents: Identity Theft Clearinghouse, Federal Trade Commission, 600 Pennsylvania Avenue, NW Washington, DC 20580, www.consumer.gov/idtheft, 1-877-IDTHEFT (438-4338), TTY: 1-866-653-4261.