Mavis Tire Data Breach Hits SSNs and Health Records: What to Do If Your Data Was Exposed

Mavis Tire Supply LLC, the company behind Mavis Discount Tire, has disclosed a data breach involving Social Security numbers, government ID numbers, financial account information, and health records. The company reported the breach to the Vermont Attorney General on November 3, 2026, and is notifying affected people by mail.

The breach is more than a year old. Mavis says it detected unauthorized access on June 18, 2025, according to the sample notification letter it filed in Massachusetts, and the Worldleaks ransomware group claimed the attack that September. Now that letters are in the mail, the next risk is scammers who copy them to collect the same information that was exposed.

No compromise. Promise

Your credit, finances, and info, all kept Safer Than Safe.

Learn more

What Happened in the Mavis Tire Data Breach?

Mavis says it detected unauthorized access to its IT environment on June 18, 2025. According to the company’s sample notification letter, a “criminal third party had copied certain data,” and Mavis brought in outside counsel and a forensics firm to review what was taken.

On September 23, 2025, the Worldleaks ransomware group claimed the attack, according to HookPhish. Mavis reported the breach to the Vermont Attorney General on November 3, 2026, about 16 months after it detected the intrusion, and listed 85 Vermont residents in that filing.

The letter does not explain why notification took that long, and it says Mavis is “not aware of any misuse” of personal information.

What Did the Worldleaks Ransomware Group Take?

Mavis has not said what Worldleaks took, and the group’s claim is not proof of what it holds. The best public record of what was exposed is the list of data categories Mavis filed with state regulators.

What Data Was Exposed in the Mavis Discount Tire Breach?

The Vermont filing lists five categories of data, including health records. Each letter lists the specific information Mavis found for that recipient.

Was My Information Exposed in the Mavis Discount Tire Breach?

A notification letter from Mavis is the clearest way to know. The sample letter says the recipient’s personal information “was found during this review” of the copied data, and it lists the types of information involved for that person.

If you shopped or worked at Mavis and have not received a letter, that does not rule you out, because filings are still coming in. Mavis has not posted a public statement on its social accounts. Watch your mail for a notification letter, and do not use “check my name” breach sites that ask for your Social Security number.

Is the Mavis Tire Breach Notification Letter Real or a Scam?

A real Mavis letter arrives by mail and offers free identity monitoring through a code printed on the letter. A fake data breach letter typically copies that wording and changes the link, the phone number, or what it asks you to send.

How to Check a Mavis Breach Letter

Compare any letter or message against the details in the sample letter Mavis filed with Massachusetts:

• Sender: signed “Mavis Tire”
• Offer: 24 months of identity monitoring through Kroll “at no cost to you”
• Enrollment: at enroll.krollmonitoring.com, using a membership number printed on the letter
• Support line: (844) 301-0180, Monday through Friday, 9 a.m. to 6:30 p.m. Eastern
• Deadline: an activation date printed on the letter

If a message differs from these details, or if someone reaches you by text, email, or phone call, don’t respond to it. Type the enrollment address into your browser yourself instead of scanning a QR code or tapping a link.

Red Flags of a Fake Data Breach Letter

For more on how these messages work, see our guide on how to protect yourself from phishing scams.

What Should I Do If I Got a Mavis Tire Data Breach Notification Letter?

Enroll in the free monitoring and freeze your credit. Those two steps cover the biggest risks from an exposed Social Security number, and the rest of this section depends on what your letter says was exposed.

1. Enroll in the monitoring before the deadline on your letter. Use the enrollment address and membership number printed on it.
2. Freeze your credit at Equifax, Experian, and TransUnion. A freeze is free, doesn’t affect your credit score, and lasts until you lift it. It stops most lenders from opening new accounts in your name.
3. Check your credit reports. The FTC points to AnnualCreditReport.com for free reports from all three bureaus. Look for accounts, addresses, or inquiries you don’t recognize.
4. Treat follow-up messages about the breach with caution. Use the checks above before you respond to anything that mentions Mavis.

If Your Social Security Number Was Exposed

There’s no single switch to lock a Social Security number, but two steps cover the most common misuse: new credit and tax refund fraud.

• Freeze your credit (step 2 above), or at least place a fraud alert. The FTC says an initial alert lasts one year and can be renewed.
• Get an IRS Identity Protection PIN. This six-digit number from the IRS stops anyone else from filing a tax return with your Social Security number. It is valid for one calendar year, and the IRS will never ask you for it.
• Create a my Social Security account at ssa.gov/myaccount to review your earnings record and watch for unusual activity.

If Your Health Records Were Exposed

Medical identity theft shows up in bills and insurance paperwork, not credit reports. The FTC lists a bill or Explanation of Benefits “for services you didn’t get” as a warning sign.

• Read every Explanation of Benefits from your insurer. Look for visits you didn’t make and services you didn’t receive.
• Report errors to your health care provider in writing, and call your insurer about claims you don’t recognize.

What to Do If Your Information Has Already Been Misused

If you find accounts, charges, tax filings, or medical claims you didn’t make, act on them in this order.

1. Call your bank or card issuer to stop or reverse unauthorized transactions and close compromised accounts.
2. Report it at IdentityTheft.gov. You’ll get an FTC Identity Theft Report and a personal recovery plan.
3. Place an extended fraud alert. The FTC says it lasts seven years and requires an identity theft report.
4. Dispute fraudulent accounts with Equifax, Experian, and TransUnion, and send each a copy of your identity theft report.
5. Contact the IRS through irs.gov if someone filed a tax return in your name.
6. File a police report if you lost money, and keep the report number.
7. Keep records of every letter, call, case number, and date.

How to Report a Fake Breach Notice or Identity Theft

Reporting helps authorities track scams that piggyback on the breach and puts your case on record.

• Federal Trade Commission (FTC): Report scam letters, texts, and calls at ReportFraud.ftc.gov, and identity theft at IdentityTheft.gov.
• FBI Internet Crime Complaint Center (IC3): Report online fraud and money lost at ic3.gov.
• Your state attorney general: Report scams to your state’s consumer protection office.
• Local police: File a report if you lost money or were threatened.

The Mavis Tire data breach unfolded slowly with notification letters going out more than a year after the 2025 attack. That delay means the exposed data has been out of Mavis’s control for a long time, and the letters arriving now give scammers a fresh pretext. The defense is the same either way: freeze your credit, and verify every message about the breach before you act on it.

Mavis Tire Data Breach FAQ

How can I tell whether my data is on the dark web after a breach?

You usually can’t confirm what a criminal group holds. Treat a notification letter as the signal, and act as if your information is exposed: freeze your credit, get an IRS Identity Protection PIN, and watch your reports and statements.

Does a credit freeze protect my health records?

No. A freeze stops new credit accounts, but it doesn’t stop someone from using your insurance or medical information. Review each Explanation of Benefits and report services you didn’t receive.