Almeida Law Group is investigating a data breach at Cambridge Mercantile Corp. (U.S.A.). The breach occurred on June 11th, 2026. If you were affected, contact Almeida Law Group.
About Cambridge Mercantile Corp. (U.S.A.)
Cambridge Mercantile Corp. (U.S.A.), doing business as Corpay, provides cross-border payment and foreign exchange services to businesses. It is a subsidiary of Corpay, Inc. (NYSE: CPAY), a publicly traded corporate payments and expense management company formerly known as FleetCor Technologies, headquartered in Atlanta, Georgia. Cambridge Mercantile Corp. (U.S.A.) is located at 300 Park Ave, New York, NY. Because the company handles international financial transactions and maintains customer relationship management data for business clients, the personal information it holds can include contact and business relationship details for individuals affiliated with its corporate customers.
What Happened?
Cambridge Mercantile Corp. (U.S.A.) was listed in a California Attorney General sample breach notice filed on September 14th, 2026. The incident was a data exfiltration resulting from a third-party supply chain attack, not a ransomware event. An unauthorized actor compromised Klue — an AI-powered competitive intelligence platform that Corpay integrates with its customer relationship management system — by exploiting a compromised legacy credential. Between June 11th and June 12th, 2026, the attacker stole OAuth tokens used by Klue’s CRM integrations and used them to exfiltrate CRM data from many of Klue’s customers, including Corpay. Corpay’s internal networks were not affected, and no customer funds, payment processing, or transaction execution were impacted. Corpay engaged cybersecurity experts to investigate and notified law enforcement. The company states its review to identify affected individuals was substantially completed on August 28th, 2026.
The personal information involved may have included names and contact details (email address or physical address). The breach notification also references an additional personalized data field, meaning some recipients may have had further data categories exposed beyond those listed in the template notice. No passwords or authentication credentials were involved, and Corpay has not identified evidence of fraud, identity theft, or misuse of affected individuals’ information. Kroll has been engaged to provide identity monitoring services at no cost to affected individuals, though the specific enrollment term and activation deadline appear as unfilled template fields in the sample notice. As many as 195 to 200 organizations may have been affected by the upstream Klue breach. Other confirmed victims include Huntress, Recorded Future, Jamf, Tanium, and HackerOne. A Telegram account purporting to represent ShinyHunters claimed responsibility on June 21st, 2026; however, ReliaQuest noted it could not independently verify this attribution, and the post also referenced the Icarus data extortion group. Class action investigation pages related to the Corpay breach have appeared on plaintiff attorney aggregator sites, but no filed class action lawsuit specific to this breach had been identified as of the research date. Separately, class action investigations are underway regarding the upstream Klue breach.
Key Facts at a Glance
- Company or Organization: Cambridge Mercantile Corp. (U.S.A.) (d/b/a Corpay)
- Industry: Financial services — cross-border payments, foreign currency exchange, and corporate payment solutions
- Location: 300 Park Ave, New York, NY
- Incident type: Third-party supply chain data exfiltration (Klue CRM integration compromise)
- Date of breach: June 11th, 2026
- Date breach discovered: August 28th, 2026
- Date of consumer notification: September 14th, 2026
- Identity theft protection offered: Yes — Kroll identity monitoring (Credit Monitoring, Fraud Consultation, and Identity Theft Restoration)
- Prior breach: No prior breaches specific to Cambridge Mercantile Corp. (U.S.A.) identified; parent company Corpay, Inc. has faced FTC and ASIC regulatory actions unrelated to cybersecurity
- Litigation status: Class action investigation underway; no filed lawsuit identified as of research date
- Source: California Attorney General Breach Report · TechCrunch · Infosecurity Magazine · ReliaQuest · Klue Official Disclosure · Class Action U — Corpay
What Should You Do?
If you received a notice from Cambridge Mercantile Corp. (U.S.A.) or Corpay, enroll in the Kroll identity monitoring services offered at no cost as soon as possible by visiting enroll.krollmonitoring.com before your activation deadline. Even if you have not received a notice, consider placing a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to help prevent unauthorized accounts from being opened in your name. Review your free credit reports at AnnualCreditReport.com and monitor your financial accounts for any suspicious activity. If you suspect your information has been misused, visit IdentityTheft.gov to report it and get a personalized recovery plan.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
