The data breach compromised names, Social Security numbers, government-issued ID numbers, financial account numbers, credit and debit card numbers, dates of birth and addresses, according to the report.
A ransomware group called Clop claimed in May 2025 that it was responsible for the breach, the report said, adding that Check City has not acknowledged the cybercriminal group’s claim and that Comparitech has not independently verified it.
According to the report, Clop first surfaced in 2019 and since that time has claimed responsibility for 457 ransomware attacks, 37 of which have been confirmed by the targeted organizations.
It was reported in October 2023 that Clop was the hacking group responsible for the MOVEit attack that accessed the email addresses of about 632,000 U.S. federal employees at the Department of Defense and the Department of Justice.
Check City did not immediately reply to PYMNTS’ request for comment.
The Texas Office of the Attorney General published a data security breach report on March 20 saying that Check City notified 3,459 Texans via U.S. mail about a data breach.
The California Office of the Attorney General said on its data security breaches page that Check City reported on March 19 a breach that occurred on April 3, 2025.
In a notice of data breach sample letter posted on the California site and dated March 19, Check City said the company discovered unauthorized access to its network around April 3, 2025, secured its network, reported the incident to law enforcement, engaged legal counsel and worked with external cybersecurity professionals to analyze the issue.
The analysis determined that some of the company’s files may have been accessed by unauthorized individuals around March 21, 2025. Check City then reviewed the potentially impacted data and on Feb. 17, determined people whose personal information may have been included among that data, according to the letter.
“To date, we do not have evidence that your information has been used to commit financial fraud or identity theft,” Check City said in the letter. “Nevertheless, out of an abundance of caution, we want to make you aware of the incident and provide complimentary credit monitoring services as a precaution.”