Payday lender Cash Express reports data breach affecting 100,000 customers

The nonbank lending company Cash Express reported to the Montana attorney general this month a data breach that gave an unauthorized party access to sensitive consumer information from more than 100,000 individuals.

The company, which provides payday loans, check cashing, title loans and other high-cost, short-term loan services, said in a letter to affected individuals that an unauthorized party obtained their personal information, including birthdates, Social Security numbers, financial information and contact information, earlier this year. The Cookeville, Tennessee-based company didn't provide specific details about how the breach occurred.

Richard Console, a personal injury lawyer, said in a legal blog that the most common harm of data breaches is hackers using people's personal information to open new credit cards or personal loans. Console told American Banker in an email that he's seen an increase in data breaches since the start of the COVID-19 pandemic, especially in 2021.

"The lesson to be learned from any data breach is that companies need to do more to protect the sensitive consumer information with which they are entrusted," Console said in the email to Banker. "Certainly, creating and maintaining robust data security protocols is an additional cost; however, given the ever-growing number of data breaches, the expense is justified."

At least 80 financial service companies have reported data breaches in 2022, according to the Office of the Maine Attorney General, though Maine only tracks breaches that affect at least one resident in the state. 

In its letter to the affected individuals, Cash Express said it hired a third-party data security firm to conduct an investigation after detecting unusual activity on its company network on Feb. 6. The investigation found an unauthorized party had accessed a portion of the company's computer system between Jan. 29 and Feb. 6. According to the Office of the Maine Attorney General, 106,521 people were affected by the breach. 

Cash Express received the results of the investigation Aug. 4, and reported the activity to the Montana attorney general and affected individuals September 15. CEO Garry McNabb said in the letter that Cash Express is offering complimentary credit card monitoring for affected individuals through a one-year membership to Experian's IdentityWorks.

The consumer lending company was founded in 1995. It operates through offices across the Midwest and South. 

In 2018, the Bureau of Consumer Financial Protection Bureau announced that Cash Express would pay a $200,000 civil money penalty and $32,000 in restitution to customers for a slew of Consumer Financial Protection Act violations involving misleading consumers.