F500 Wholesalers Remainder · Wholesalers: Diversified · Data breach
LKQ
Headline
One data incident found (supplier data, Oracle E-Business Suite exploitation, notified December 2025 - see data-sharing column); nothing consumer-facing confirmed.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
One data incident found (supplier data, Oracle E-Business Suite exploitation, notified December 2025 - see data-sharing column); nothing consumer-facing confirmed. LKQ distributes recycled and aftermarket vehicle parts, primarily to repair shops rather than consumers, and its salvage operations mean it handles vehicles - and any data left in them. Vehicle infotainment systems retain paired phone contacts, call logs and location history, and salvage and resale is the point at which that data most often escapes without anyone noticing. Recommend a follow-up on data wiping practice in the vehicle salvage chain; it is a genuine gap.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not applicable — no consumer relationship exists.
Data sharing
LKQ operates as a wholesale distributor or contract manufacturer selling to OTHER BUSINESSES (primarily collision and mechanical repair shops) rather than directly to individual consumers — it has no meaningful direct consumer account relationship or Terms of Service that an ordinary person would ever encounter or agree to. DATA INCIDENT (supplier data): per LKQ's sample notice filed with the California AG (dated Dec. 15, 2025; breach date listed Aug. 9, 2025), a third party exploited a previously unknown vulnerability in Oracle E-Business Suite; LKQ opened an investigation Oct. 3, 2025, took the system offline, and reported no evidence of impact beyond that environment. The notified individuals were sole-proprietor suppliers whose Employer Identification Number or Social Security number was affected; LKQ offered complimentary credit monitoring. No SEC Item 1.05 Form 8-K was filed.
Fees and billing
Not applicable.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy No consumer-facing Privacy Policy identified | Not fetched yet | N/A |
| Terms of service No consumer-facing Terms of Service identified — this is a B2B wholesale/distribution company | Not fetched yet | N/A |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.