Recommended Free Tools
The Stellantis auto manufacturer confirmed a breach on September 21, 2025, involving unauthorized access to a third-party platform used for North American customer-service operations. Stellantis said limited customer contact information was exposed, not financial or sensitive personal data, while reports of Salesforce, ShinyHunters, and 18 million records were unconfirmed.
The disclosure answers the central question—yes, Stellantis confirmed unauthorized access—but leaves important details unresolved. The company did not identify the service provider, publish the exact contact fields involved, or disclose a confirmed number of affected customers.
As an Amazon Associate I earn from qualifying purchases.
Key takeaways
- Stellantis confirmed unauthorized access on September 21, 2025, to a third-party platform supporting its North American customer-service operations.
- Stellantis said the exposed information was limited to customer contact information and did not include financial details or sensitive personal data.
- The company said it activated incident-response procedures, investigated and contained the event, notified authorities, and directly informed affected customers.
- Reports linked the incident to Salesforce-related attacks and cited an alleged 18 million stolen records, but Stellantis did not confirm either claim.
- A later lawsuit over an alleged December 2025 FCA US ransomware incident is separate and should not be treated as proof about the September breach.
What did Stellantis confirm about the breach?
Stellantis confirmed that unauthorized access reached a third-party platform supporting North American customer-service operations on September 21, 2025. The automaker said the incident exposed limited customer contact information, not financial details or sensitive personal data. Stellantis said it investigated, contained the event, notified authorities, and contacted affected customers.
Reuters reported the company’s disclosure on September 21, 2025, and the company statement was also reproduced by BleepingComputer’s breach report. Stellantis later described the same event in its 2025 Expanded Sustainability Statement.
#1 Best Overall
- Real-Time Location Tracking with No Monthly Fees: Keep track of what matters most without any hidden costs. This GPS locator uses the SeekTag app to show your item's real-time location on your phone. There are no subscriptions and no SIM card required, making it a cost-effective tracking solution for your auto, motorcycle, truck, or trailer. You can track over a long distance with peace of mind.
- Universal Compatibility for Both iOS and Android: Whether you use an iPhone or an Android phone, this smart tracker works seamlessly for everyone. Simply download the free SeekTag application, pair the device via wireless Bluetooth connection, and you're ready to start tracking. It's the perfect personal equipment for families with mixed phone types.
- Compact, Durable Design with Multiple Attachments: Despite its powerful tracking capabilities, this device is remarkably small, tiny, and portable. The included magnetic mount securely attaches to metal surfaces, while the keychain allows for easy attachment to dog collars, kid backpacks, or luggage. With an IP65 rating, it's protected against dust and water splashes, ready for any adventure.
- Versatile Tracking for Your Valuables, Pets, and People: This isn't just for cars. Use it as a pet tracker to monitor your dogs & cats` location, a child locator for your children's safety, or an item finder for your bags and valuables. Its long range and tiny size make it an incredibly versatile tool for protecting your people and possessions from being lost.
- Reliable and Discreet for Long-Term Use: Engineered for reliability, this locator is designed for long-term use. Its efficient power management ensures a long battery life up to 360 days, providing extended tracking without frequent replacement battery. The small and undetectable design allows for discreet placement on your auto or other personal items, offering a reliable security solution.
Stellantis’s statement said: “We recently detected unauthorized access to a third-party service provider’s platform that supports our North American customer service operations.” The statement described the platform as a service-provider system; Stellantis did not publicly say that a vehicle, factory control system, or core vehicle software system was compromised.
What information was exposed in the Stellantis data breach?
Stellantis said the affected data was limited to customer contact information. The company specifically said that financial details and sensitive personal data were not exposed, according to contemporaneous reporting and the company’s later sustainability statement.
Stellantis did not publish a complete field-level inventory. The available company description does not confirm whether the affected records contained names, email addresses, telephone numbers, postal addresses, or any particular combination of those fields. The most accurate description is therefore “customer contact information,” rather than a more specific list inferred from secondary reports.
| Data or system question | What the public record supports |
|---|---|
| Customer contact information | Stellantis said limited contact information was stored on the affected platform. |
| Financial information | Stellantis said financial details were not exposed. |
| Sensitive personal information | Stellantis said sensitive personal data was not exposed. |
| Social Security numbers | Not identified as exposed in the Stellantis statements reviewed. |
| Vehicle systems or factory systems | Not identified as affected; the confirmed system was a third-party customer-service platform. |
How many people were affected by the Stellantis breach?
Stellantis did not disclose an authoritative, company-confirmed number of affected customers in the material reviewed. Approximately 18 million records was an allegation reported by TechCrunch and attributed to hacker claims, not a confirmed Stellantis breach total.
According to TechCrunch’s September 2025 report, outside claims associated with the incident alleged that approximately 18 million customer records were stolen. That figure should not be rewritten as “Stellantis lost 18 million records,” because Stellantis did not confirm the number in the company statement reviewed. A record count also does not necessarily equal a count of unique people: one customer could have more than one record, and a record could contain more than one contact field.
Was the Stellantis breach connected to Salesforce or ShinyHunters?
Outside reporting associated the Stellantis incident with a broader wave of Salesforce-related attacks and claims involving the ShinyHunters extortion group, but Stellantis did not confirm the provider’s identity or the attackers’ identity in its public statement.
BleepingComputer reported the Salesforce-related context, while TechCrunch reported the alleged 18-million-record claim. Those are secondary reports and attacker-associated claims, not independent forensic findings disclosed by Stellantis. The confirmed fact is narrower: an unauthorized party accessed a third-party platform used for North American customer-service operations.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →| Claim | Status | Safe wording |
|---|---|---|
| Stellantis experienced unauthorized access | Confirmed by Stellantis | Stellantis confirmed a breach involving a third-party customer-service platform. |
| The provider was Salesforce | Reported or inferred externally; not confirmed by Stellantis | Reports linked the incident to Salesforce-related attacks. |
| ShinyHunters was responsible | Outside attribution or claim; not confirmed by Stellantis | Claims associated the incident with ShinyHunters. |
| 18 million records were stolen | Alleged in secondary reporting; not confirmed by Stellantis | Reports cited an alleged figure of approximately 18 million records. |
| Social Security numbers were exposed | Not supported by the company statements reviewed | Stellantis said sensitive personal data was not exposed. |
Which Stellantis customers were affected?
The confirmed geographic scope was North American customer-service operations, not every Stellantis customer or vehicle owner worldwide. The public statement did not establish that every Jeep, Chrysler, Dodge, Ram, or Fiat owner was affected.
Rank #2
- Premium GPS Tracker — The LandAirSea 54 GPS tracker provides accurate global location, real-time alerts, and geofencing. Easily attaches to vehicles, ATVs, golf carts, or other critical assets.
- Track Movements in Real-Time — Track and map (with Google Maps) in real-time on web-based software or our SilverCloud App. Location updates as fast as every 3 seconds with historical playback for up to 1 year.
- Powerful & Discreet — The motion-activated GPS tracker will sleep when not in motion for extended periods, preserving the battery life. The ultra-compact design and internal magnet create the ultimate discreet tracker.
- Lifetime Warranty — This GPS tracker is built to last. LandAirSea, a USA-based company and pioneer in GPS tracking offers a unconditional lifetime warranty that covers any manufacturing defects in the device encountered during normal use.
- Subscription Required — Affordable subscription plans are required for each device. Fees start as low as $9.95 a month for annual plans and $19.95 for monthly plans. No contracts, cancel anytime for a hassle-free experience.
Stellantis said it was directly informing affected customers. Customers who receive a notice should assess that notice through an independently verified official Stellantis channel rather than trusting contact information or links contained in an unexpected email, text message, or phone call.
What should customers do about a suspicious Stellantis email or text?
Customers should treat unexpected messages as potential phishing attempts, avoid clicking embedded links, and avoid sharing personal information in response to unsolicited emails, texts, or calls. Stellantis gave the same warning in its customer guidance, reproduced by Top Class Actions’ report.
- Do not click the message’s link or open an unexpected attachment. A message can imitate Stellantis branding without coming from Stellantis.
- Do not provide passwords, payment details, Social Security numbers, verification codes, or other personal information in response to the message.
- Verify independently. Type an official Stellantis web address into the browser or use a phone number obtained independently from an official source, rather than using the message’s contact details.
- Check whether the notification is addressed to you and describes a customer-service relationship you recognize. The breach did not affect every Stellantis owner by default.
- Report or delete the suspicious message after preserving enough information to document it. If a customer has already clicked a link or supplied credentials, changing the affected password through the legitimate service and contacting the relevant financial institution may be appropriate.
Stellantis’s statement advised customers to remain vigilant and to avoid clicking suspicious links or sharing personal information after unexpected communications. The warning is precautionary; it does not establish that a particular phishing message came from the breach or that every customer received one.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsDid Stellantis contain and investigate the incident?
Stellantis said it activated incident-response protocols, began a comprehensive investigation, took action to contain and mitigate the situation, notified authorities, and directly informed affected customers. Stellantis’s wording describes the company’s response; it is not a substitute for a public independent forensic report.
The company’s privacy policy also says that, where required by applicable law, Stellantis will notify individuals and the competent data-protection authority after a qualifying security breach. The policy describes a notification commitment, not a further disclosure of this incident’s affected-record count or technical cause.
Is the later FCA US ransomware lawsuit the same incident?
No public evidence in the reviewed sources establishes that the later FCA US ransomware allegation was the same event as the September 2025 third-party-platform breach. Legal reporting describes a separate alleged December 2025 ransomware attack involving FCA US LLC, which does business as Stellantis North America.
A January 2026 proposed class-action complaint alleged that an attacker accessed and later published sensitive customer information. Those claims remain allegations in litigation. The lawsuit should not be used as proof that the September breach exposed Social Security numbers, financial information, or other sensitive data. ClassAction.org’s summary of the later lawsuit identifies the December 2025 allegation separately from the September disclosure.
What remains unknown about the Stellantis breach?
The public material reviewed does not establish several important details:
Rank #3
- LONG-BATTERY VEHICLE TRACKING – Built for cars, trailers, fleets, equipment, boats, and motorcycles, Tracki’s trailer GPS tracker uses a 10,000mAh battery for 2 to 7 months active at 1–5 minute updates or up to 12 months in sleep mode.
- SUBSCRIPTION-POWERED SERVICE – The Tracki GPS tracker connects through 4G LTE Cat1 with built-in global SIM, giving app access, real-time location updates, alerts, and support after activation; Subscription Required, Cancel Anytime.
- FLEET-WIDE CONTROL – A practical fleet GPS tracker for work vehicles, with subscription-powered 15-second to 1-minute updates plus speed, geofence, movement, idle time, impact, and battery alerts through SMS, email, and app notifications.
- TRAILER & ASSET COVERAGE – A GPS tracker for trailer, car, truck, RV, boat, or equipment use, with 185+ country coverage, GPS accuracy of 5 to 10 meters outdoors, and Wi-Fi fallback indoors when GPS signals are harder to reach.
- SECURE TWO-WHEEL MONITORING – Use this motorcycle tracker for authorized bikes and powersport assets, with a built-in strong magnet, included screw mount, and weatherproof design for flexible vehicle placement.
- The identity of the third-party service provider.
- The exact contact-information fields stored on the platform.
- The number of affected customers or unique individuals.
- The precise intrusion method and vulnerability.
- The attacker’s identity.
- Whether the alleged 18 million records were authentic, complete, or unique customer records.
- A final public forensic conclusion that expands or narrows Stellantis’s initial description.
Those gaps matter because a breach headline can combine confirmed company facts with unverified attacker claims. Until Stellantis or an authoritative investigation provides more detail, readers should distinguish the confirmed exposure of limited contact information from the unconfirmed record-count, provider, and attribution claims.
What does Stellantis’s later Microsoft cybersecurity initiative mean?
In April 2026, Stellantis announced a strategic collaboration with Microsoft that included strengthening a global cyber-defense center with AI-driven analytics across information-technology systems, connected vehicles, manufacturing sites, and digital products. The announcement is a later cybersecurity initiative, not evidence that the September 2025 breach involved vehicle systems or that the initiative resolved the earlier incident.
The Stellantis-Microsoft announcement should therefore be read as broader security and digital-transformation context. It does not change the confirmed scope of the September event: unauthorized access to a third-party platform supporting North American customer service.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteFrequently Asked Questions
Was my Jeep, Chrysler, Dodge, Ram, or Fiat information stolen?
Stellantis confirmed unauthorized access to a third-party platform supporting its North American customer-service operations, but the company did not confirm that every Jeep, Chrysler, Dodge, Ram, or Fiat owner was affected. Stellantis said it was directly informing affected customers.
How many people were affected by the Stellantis breach?
Stellantis did not disclose a company-confirmed number of affected customers. Approximately 18 million allegedly stolen records was a figure attributed to hacker claims in secondary reporting, not a confirmed Stellantis total.
Was the Stellantis breach connected to Salesforce or ShinyHunters?
Reports linked the incident to a wave of Salesforce-related attacks and claims involving ShinyHunters, but Stellantis did not publicly confirm the provider or attacker identity in the statement reviewed.
Did the Stellantis breach expose Social Security numbers?
Stellantis said the exposed information was limited to customer contact information and that financial details and sensitive personal data were not exposed. The company statements reviewed did not identify Social Security numbers as exposed.
The Bottom Line
Bottom line: Stellantis confirmed a September 2025 breach of a third-party customer-service platform serving North America. The automaker said limited customer contact information was exposed, while financial and sensitive personal data were not. Salesforce, ShinyHunters, and the alleged 18-million-record total remain externally reported or claimed, not confirmed Stellantis facts.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
