Almeida Law Group is investigating a data breach at Challenge Financial Services, Inc. The breach occurred on August 17th, 2026. If you were affected, contact Almeida Law Group.
About Challenge Financial Services, Inc.
Challenge Financial Services, Inc. is an indirect auto finance company that purchases and services sub-prime auto loans originated by independent and franchise dealers. The company is headquartered at 1004 W Taft Ave, Suite 100, Orange, California, with additional offices in Tucson, Arizona and Chula Vista, California. It is a privately-held, family-owned business that has been in operation since 1994, with more than $85 million in outstanding receivables under management and between 51 and 200 employees. Because the company finances and services auto loans, it likely holds sensitive consumer financial and personal information, making any unauthorized access to its systems a serious concern for borrowers.
What Happened?
Challenge Financial Services, Inc. was listed in a California Attorney General sample breach notice, with the breach reported to the California AG on September 29th, 2026 and an occurrence date of August 17th, 2026. The notice PDF was not available for review, so the specific type of incident, the data types exposed, and the number of persons affected were not specified in the source materials.
Separately, the ransomware tracking site Ransomware.live reported that on August 31st, 2026, a group calling itself “Settra” posted a listing on its dark web leak site claiming cfsnow.com as a victim, with an estimated attack date of August 18th, 2026. The Settra listing allegedly described “Internal Documents of a California Auto Lending Company” and claimed 173 GB of exfiltrated data. These are attacker-side assertions only. RedPacket Security has noted that Settra listings have included unverified or fabricated victim claims and treats this listing as unconfirmed. Challenge Financial Services has not publicly confirmed or denied a ransomware attack. No independent media reporting corroborating the Settra claim was located. No prior breaches, public litigation, or ransom demand figures were found in connection with this incident.
Key Facts at a Glance
- Company or Organization: Challenge Financial Services, Inc.
- Industry: Financial Services — Sub-prime Auto Lending / Credit Intermediation
- Location: Orange, California
- Date of breach: August 17th, 2026
- Date of consumer notification: September 29th, 2026 (date reported to California AG)
- Source: California Attorney General Data Breach Report; Ransomware.live — Victim: cfsnow.com (Settra); RedPacket Security — [SETTRA] Ransomware Victim: cfsnow.com
What Should You Do?
If you received a notification from Challenge Financial Services, Inc., review it carefully for any identity protection enrollment offer and sign up before the deadline if one is provided. Even without a formal offer, you should place a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to help prevent unauthorized accounts from being opened in your name. Monitor your bank accounts, loan accounts, and credit reports closely for unfamiliar activity. You can request free copies of your credit reports at AnnualCreditReport.com. If you believe your information has been misused, visit IdentityTheft.gov for step-by-step guidance on recovering from identity theft.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
