Almeida Law Group is investigating a data breach at Corpay, Inc. If you were affected, contact Almeida Law Group.
About Corpay, Inc.
Corpay, Inc. (NYSE: CPAY), formerly known as FLEETCOR Technologies, is a global S&P 500 corporate payments company headquartered in Atlanta, Georgia, with operations in over 100 countries. It offers solutions including fuel cards, accounts payable automation, cross-border payments, currency risk management, and commercial card programs, and reported approximately $4.76 billion in 2025 revenues. This breach was reported through its subsidiary Cambridge Mercantile Corp. (U.S.A.), which provides cross-border payment and foreign exchange services under the Corpay brand.
What Happened?
Corpay, Inc. was listed in a Vermont Attorney General breach report summary filed on September 21st, 2026. The breach involved government ID numbers, and the Massachusetts Attorney General filing filed by the subsidiary Cambridge Mercantile Corp. (U.S.A.) on September 14th, 2026, confirms that Social Security numbers were among the data categories involved. Corpay’s own notification letter states that exposed information included names and contact details such as email or physical addresses, along with individualized data categories that varied by recipient. No passwords or authentication credentials were involved. Corpay launched an investigation with third-party cybersecurity experts, found no evidence that customer funds, payment processing, or service availability were affected, and found no evidence of fraud or identity theft. The company engaged Kroll to provide complimentary identity monitoring services to affected individuals. Corpay’s investigation to identify affected individuals was substantially completed on August 28th, 2026, with notification letters going out in September 2026 — a roughly three-month gap from the June 11th, 2026, incident date that has drawn commentary.
Multiple law firms, including Emery Reddy, Federman & Sherwood, and Dapeer Law, have announced investigations into potential class action lawsuits related to this breach, though no class action complaint has been filed as of the research date. Separately, in January 2026, the Eleventh Circuit Court of Appeals affirmed an FTC judgment against Corpay for deceptive advertising and unfair billing practices related to fuel cards — a matter unrelated to this data breach. Corpay also recorded a $100 million charge in Q2 2026 for a preliminary FTC settlement in that matter. In addition, when operating as FLEETCOR Technologies in 2018, the company disclosed unauthorized access involving its Stored Value Solutions gift card business, though that incident did not involve personally identifiable information such as names or Social Security numbers.
Key Facts at a Glance
- Company or Organization: Corpay, Inc. (subsidiary: Cambridge Mercantile Corp. (U.S.A.))
- Industry: Financial Services / Corporate Payments and Payment Processing
- Location: Atlanta, Georgia; operations in over 100 countries
- Incident type: Unauthorized access
- Date of breach: June 11th, 2026
- Date breach discovered: August 28th, 2026
- Date of consumer notification: September 14th, 2026 (Massachusetts and California filings); September 21st, 2026 (Vermont filing)
- Identity theft protection offered: Yes — complimentary identity monitoring through Kroll
- Prior breach: Yes — 2018 unauthorized access to gift card data when operating as FLEETCOR Technologies (no PII involved)
- Litigation status: Multiple law firm investigations announced; no class action complaint filed as of the research date
- Source: Vermont Attorney General breach report summary; Massachusetts AG notification letter; Emery Reddy investigation; GalaxyWarden — California AG filing details
What Should You Do?
If you received a notification from Corpay or Cambridge Mercantile Corp. (U.S.A.) about this breach, take immediate steps to protect yourself. Enroll in the complimentary Kroll identity monitoring service if you have not already done so, and note any enrollment deadline communicated in your notification letter. Consider placing a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to help prevent new accounts from being opened in your name. Monitor your existing financial accounts closely for unauthorized transactions, and pull your free credit reports at AnnualCreditReport.com to review them for unfamiliar activity. If you suspect your information has been misused, you can report identity theft and get a personalized recovery plan at IdentityTheft.gov.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
