About LKQ Corporation
LKQ Corporation, a commercial entity based in Antioch, Tennessee, experienced a data breach affecting 9,070 individuals, including 31 residents of Maine. The breach involved an external system hacking incident that was discovered on October 3, 2025, but had occurred earlier on August 9, 2025. The breach primarily compromised personal identifiers in combination with other data.
What Happened
Recently, Oracle announced a number of security vulnerabilities, including a previously unknown vulnerability in its E-Business Suite application, which is used by LKQ and many other organizations worldwide. In early October, our security team became aware of a third party exploiting these vulnerabilities.
The breach involved a hacking incident on an external system, specifically targeting Oracle’s E-Business Suite application used by LKQ. The breach affected personal information of sole proprietor suppliers, including their Employer Identification Number or Social Security number. The breach occurred on August 9, 2025, and was discovered on October 3, 2025.
Next Steps
Affected individuals should enroll in the offered credit monitoring and identity restoration services by March 31, 2026, to ensure their personal information is monitored effectively. It is advisable to remain vigilant against identity theft and fraud by regularly reviewing account statements and credit reports for any unauthorized activities. If suspicious activity is detected, individuals are encouraged to contact local law enforcement and the dedicated call center established by LKQ for further assistance.
Identity Theft Protection Services
LKQ Corporation is providing affected individuals with two years of complimentary identity theft protection services through Cyberscout, a TransUnion company. This includes credit monitoring, identity theft restoration, and proactive fraud assistance. The services offer alerts for changes to credit files and assistance in the event of fraudulent activity. Enrollment in these services requires an internet connection and an email account, and must be completed by March 31, 2026.