The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Stellantis confirmed that attackers accessed a third-party platform supporting North American customer-service operations in September 2025. The company initially said customer contact information was stolen. Later Stellantis disclosures describe the affected platform as holding limited contact information—not financial or sensitive personal information.
A widely reported claim that approximately 18 million records were taken has not been confirmed by Stellantis and should not be treated as a count of affected customers.
As an Amazon Associate I earn from qualifying purchases.
What Stellantis confirmed
Stellantis said an unauthorized party gained access to a platform operated by a third-party service provider for its North American customer-service operations. The company investigated and contained the incident, notified relevant authorities, and directly informed affected customers, according to its 2025 Expanded Sustainability Statement.
This was described as an incident involving a vendor-operated customer-service platform. The available evidence does not establish that Stellantis’ core corporate network, vehicle computers, telematics systems, connected-car functions, dealership systems, or safety systems were compromised.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The original disclosure was reported on September 22, 2025. This is therefore an update to a 2025 breach report, not evidence of a newly announced August 2026 incident.
What information was exposed?
Stellantis initially characterized the stolen information as contact information. Its later corporate reporting narrows that description: the affected platform stored limited contact information and did not store financial or sensitive personal information.
Stellantis has not publicly established, in the evidence available for this update, whether individual records contained:
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Full names, email addresses, telephone numbers, or postal addresses
- Vehicle identification numbers or service history
- Dealer details, account identifiers, or marketing preferences
- Customer-support transcripts or login credentials
- Social Security numbers or driver’s-license numbers
- Payment-card or bank-account information
The authoritative answer for an individual customer is the breach notice they received. “Contact information” can be useful to scammers, but it is materially different from payment data, government identification numbers, or account passwords. Stellantis’ later disclosures say those financial and sensitive categories were not stored on the affected platform; that is the company’s characterization of the system, not a guarantee about every other Stellantis or dealer system.
How many customers were affected?
Stellantis did not initially publish the number of customers it was notifying. Reports cited hacker-linked claims that approximately 18 million records had been stolen.
That figure remains unverified. It came from claims attributed to the attackers, not from a confirmed Stellantis customer count or an independently established regulatory figure. Records are not the same as people: a database estimate may include duplicates, outdated entries, incomplete records, or data that does not correspond to affected individuals.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The accurate description is: hackers claimed approximately 18 million records were taken, but Stellantis has not publicly confirmed that number or said that 18 million customers were affected.
Was Salesforce involved?
TechCrunch reported that the incident was linked to a Salesforce database and attributed claims of responsibility to the ShinyHunters hacking group. However, Stellantis’ later annual and sustainability reports describe the affected system more generally as a third-party service-provider platform. Those filings do not independently confirm that Salesforce was the breached platform.
It is therefore more precise to say that reports linked the incident to Salesforce, while Stellantis’ own disclosures confirm unauthorized access to a third-party customer-service platform. The available evidence does not establish the technical attribution beyond that.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Which Stellantis customers may be affected?
The confirmed scope concerns North American customer-service operations. Stellantis’ broader portfolio includes Chrysler, Dodge, Jeep, Ram, Fiat, Alfa Romeo, Maserati, Peugeot, Citroën, Opel, Vauxhall, DS Automobiles, Abarth, Lancia, Free2move, and Leasys, but ownership of one of those brands does not by itself prove that a customer was included.
Brand and regional notification practices can differ. Use the individual notice—not the vehicle brand, dealership relationship, or a social-media post—as the basis for deciding whether your information was involved. Stellantis provides brand- and geography-specific contact routes on its official contacts page.
Free tools Windows power users keep installed
One-click scans. No signup required.
What customers should do now
- Read any notification carefully. Check the named brand or service, affected dates, data categories, and any instructions. A legitimate notice should not require you to surrender additional passwords or payment details simply to confirm receipt.
- Verify unexpected messages independently. Do not click links in unsolicited emails or texts claiming to offer breach assistance, warranty service, a recall appointment, or account recovery. Type the official Stellantis or brand address into your browser or use the contact information on Stellantis’ official website.
- Expect targeted impersonation attempts. Someone who knows your name, vehicle brand, contact details, or service relationship may pose as Stellantis, a dealership, a warranty provider, or a roadside-assistance company. Be especially cautious if a caller requests a password, one-time code, payment, vehicle documents, or an identity scan.
- Change passwords when there is a reason to do so. Change a password if your notice says credentials were involved, or if you reused a password associated with Stellantis services elsewhere. Use a unique password and turn on multifactor authentication where the service supports it. The available Stellantis disclosures do not establish that login credentials were stored on the affected platform.
- Monitor accounts and credit reports. Watch financial accounts and credit reports for unusual activity, but do not assume that contact-data exposure means payment information was stolen.
- Consider a credit freeze only when appropriate. A freeze is particularly relevant if your personal notice identifies exposure of a Social Security number or government-issued ID. Stellantis’ later disclosures say sensitive personal and financial information was not stored on the affected platform, so a freeze is not automatically necessary for every reader based solely on this incident.
- Report suspected fraud promptly. Contact your financial institution using its official number, and report identity-related fraud to the FTC’s IdentityTheft.gov service or appropriate law-enforcement authorities.
What this breach does—and does not—mean
| What the evidence supports | What it does not establish |
|---|---|
| Unauthorized access to a third-party platform supporting North American customer service | That every Stellantis customer was affected |
| Customer contact information was taken | That payment cards, bank details, Social Security numbers, or driver’s licenses were exposed |
| Stellantis later described the stored data as limited contact information | That 18 million customers were affected |
| Customer and regulator notifications were made | That vehicle controls, remote-start functions, telematics, or safety systems were breached |
| Reports linked the incident to Salesforce | That Salesforce is independently confirmed as the compromised platform |
Stellantis’ response and remaining questions
Stellantis says it activated its incident-response process, investigated and contained the event, notified relevant authorities, and directly contacted affected customers. Its 2025 Annual Report says the incident had not materially affected the company and describes the platform as not storing financial or sensitive personal information.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Some details remain undisclosed in the available public reporting: the exact contact fields involved, the confirmed number of affected individuals, and independent technical confirmation of the reported Salesforce connection. Those gaps are why an individual notification remains more useful than the widely repeated 18-million-record allegation.
Updated August 18, 2026, to include later Stellantis disclosures describing the affected platform as storing limited contact information and not financial or sensitive personal information.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
