Corpay, Inc. Data Breach Notice (South Carolina Attorney General): What Was Exposed & What To Do

Data breaches affecting corporate payment and fleet-management firms continue to surface through state attorney-general and consumer-affairs filings, even when the underlying technical details remain sparse. In this environment, notices that reach only a few thousand residents still matter because the companies involved routinely handle identifiers tied to employees, drivers, and business customers.

Corpay, Inc. has filed a data-breach notice with South Carolina authorities covering 1,041 people. The filing, dated September 21, 2026, states that personal information was involved; beyond that public detail is limited. The notice is consequential for anyone whose records may have been among those affected and for the broader sector that relies on Corpay’s services.

What happened

According to the breach notification reported to the South Carolina Department of Consumer Affairs on September 21, 2026, Corpay, Inc. informed South Carolina residents that a data breach had occurred. The filing lists 1,041 individuals as affected. The only data category named is personal information. The notice does not disclose the date the incident began or was discovered, the method of unauthorized access, the systems involved, or whether any data was exfiltrated beyond the fact that personal information was exposed. No threat actor is identified in the public record.

How a breach like this happens

Incidents of this general type typically begin when an attacker obtains an initial foothold—commonly through stolen or guessed credentials, a phishing message that yields remote access, an unpatched internet-facing service, or a compromised third-party vendor that already has connectivity into the target environment. Once inside, the intruder may move laterally, locate databases or file shares containing customer or employee records, and copy or encrypt those records. Detection often occurs days or weeks later through unusual outbound traffic, endpoint alerts, or notification from a business partner. Organizations then conduct forensic review, determine the scope of data involved, and issue the state-mandated notices that appear in attorney-general or consumer-affairs portals. Because the Corpay filing supplies no technical narrative, the precise sequence in this case remains undisclosed; the outline above is background only and is not a description of the Corpay event itself.

Who is Corpay, Inc.?

Corpay, Inc. is a publicly known provider of corporate payment, fleet-card, and expense-management solutions. Companies in this sector typically maintain records on business customers, cardholders, drivers, and employees—information that can include names, contact details, account or card identifiers, and sometimes government-issued numbers or other personal data needed for compliance and billing. A breach at such an organization is consequential because the same identifiers are frequently reused across financial and employment contexts, raising the possibility of downstream fraud or identity misuse even when the absolute number of affected individuals is modest.

The information in question

The South Carolina filing states that personal information was exposed. It does not itemize the precise fields. Organizations of Corpay’s type commonly hold names, addresses, dates of birth, Social Security numbers or other government identifiers, driver’s-license data, account numbers, and employment or fleet-related details. Whether any or all of those elements were present in the Corpay incident is unconfirmed; the public record simply uses the umbrella term “personal information.” Readers should treat the exact contents as undisclosed until Corpay or regulators provide further clarity.

The real-world impact

For the 1,041 people named in the notice, the primary risks are the ordinary consequences of personal-data exposure: targeted phishing, account-takeover attempts, and potential new-account fraud if government identifiers were included. Because the filing does not confirm which fields were involved, the severity for any single individual cannot be ranked from public sources alone. For Corpay, the incident triggers notification costs, possible regulatory inquiry, and the need to support affected customers and employees. No dollar figures, litigation outcomes, or additional victim counts appear in the available disclosure.

Were you affected?

If you received a letter or email from Corpay referencing the September 2026 South Carolina notice, treat it as authoritative for your own status and follow the instructions it contains—typically placing fraud alerts, monitoring account statements, and, where offered, enrolling in complimentary credit monitoring. Even without a direct letter, you can review recent account activity for unfamiliar charges and consider a free exposure scan of your email address against known breach data sets to see whether your information has appeared elsewhere. Keep records of any correspondence and remain alert for unsolicited requests that cite the breach as a pretext for further information.

AICompiled with AI assistance from public sources and published under our editorial standards.