Corpay Data Breach Exposes Financial and Personal Information

In September 2026, Corpay, Inc., a major global corporate payments company, formally reported a data security incident to the Indiana Attorney General. This breach, which occurred on November 17, 2025, involved the compromise of substantial volumes of sensitive information, raising serious concerns for thousands of individuals and corporate clients whose data Corpay handles.

The compromised data categories include individuals' Full Name, Social Security Number, Date of Birth, Financial Account Number, Routing Number, Tax Identification Information, Wage and Compensation Information, Direct Deposit Details, and Email Address. This specific combination of exposed data carries significant long-term risks, such as identity theft, financial fraud, and potential tax fraud. With access to this information, unauthorized parties could attempt to open new accounts, divert payments, or file fraudulent tax returns in your name.

As a financial technology firm, Corpay is subject to stringent federal and state regulations, including the Gramm-Leach-Bliley Act, which mandate robust data security practices to protect non-public personal information. The occurrence of this breach suggests potential shortcomings in their security measures, such as inadequate network protection or delayed vulnerability patching, which are designed to safeguard sensitive data from unauthorized access.

If you have received an official data breach notification letter from Corpay, Inc., it means your personal and financial information was directly involved in this security incident. This notice establishes your standing to seek legal action. Our law firm is investigating potential class action claims on behalf of those affected by the Corpay data breach. We manage these complex privacy cases on a contingency fee basis, meaning there are no out-of-pocket costs to you, and we only get paid if we secure compensation for you.