F500 Retail & Grocery · Specialty Retailers: Other · Structural / no discrete incident
AutoZone
Headline
AutoZone was caught in the MOVEit vulnerability - the 2023 file-transfer flaw documented across this tracker that produced breaches at dozens of entirely unrelated organisations, including Delta Dental in…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
AutoZone was caught in the MOVEit vulnerability - the 2023 file-transfer flaw documented across this tracker that produced breaches at dozens of entirely unrelated organisations, including Delta Dental in Life-Health-Dental. One flaw in one vendor's product, and a customer's exposure had nothing to do with which auto parts retailer they chose. This is the same lesson as SITA, AMCA, CDK and Salesloft, and at this point in the tracker the repetition is itself the most important finding: the security boundary that determines consumer exposure is almost never the company whose name is on the receipt.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
CONFIRMED BREACH via the SAME broader MOVEit vulnerability documented for Hartford Insurance, TIAA, and Delta Dental elsewhere in this tracker: attackers exploited the MOVEit flaw on or about May 28, 2023; AutoZone determined on or about August 15, 2023 that data had been exfiltrated and notified 184,995 individuals in November 2023 (reported to authorities November 21, 2023), roughly three months later. The Maine AG listing, as reported, cites names and Social Security numbers; the notified population is not described as customers, and the files the attackers leaked were employee and payroll records. A reported class action (filing date and docket not verified this pass) alleges the notification was both DELAYED AND INADEQUATE, lacking specifics about the attack or the stolen data's current location, and demands AutoZone fully encrypt customer data and establish firewalls/monitoring systems going forward.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. PUBLIC COMPANY (AZO). Service route: c/o General Counsel / Corporate Secretary, Memphis, Tennessee — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy autozone.com/l/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service autozone.com/l/terms-of-use | Not fetched yet | NO (HTML only) |
| Website autozone.com | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
Headquarters on file: Tennessee. Provisions of TIPA on file:
| Provision | Type | Source |
|---|---|---|
| Enforcement — AG; 60-Day Cure; Treble Damages for Willful Violations Tenn. Code Ann. § 47-18-3313 | hard | source |
| Affirmative Defense — NIST Privacy Framework Alignment Tenn. Code § 47-18-3213 | soft | source |
| Applicability Threshold — Highest Primary Tier (175k) + $25M Revenue Floor Tenn. Code § 47-18-3303 | threshold | source |