Stellantis Data Breach Lawsuit: Two Incidents, One Dropped Case, No Settlement
Case Dismissed
Stellantis — the parent of Jeep, Ram, Dodge and Chrysler — had two separate data incidents in North America within about three months: a third-party customer-service platform in September 2025, and an alleged ransomware attack on FCA US around Christmas 2025. One class action was filed over the second. According to Law360, the plaintiffs voluntarily dropped it in May 2026. As of October 2026 there is no Stellantis data breach settlement, no fund, no claim form and no deadline.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Happened, and What the Lawsuit Claimed
Incident 1 — September 2025. On September 21, 2025 Stellantis said it had detected unauthorized access to “a third-party service provider’s platform that supports our North American customer service operations.” The company said the data was “limited to contact information” and that no financial or sensitive personal information was stored on that platform or accessed. It did not say how many people were affected or name the vendor. BleepingComputer reported the incident was part of a wave of Salesforce data thefts; the extortion group behind that wave claimed it took over 18 million Salesforce records from Stellantis — a claim, not a confirmed figure.
Incident 2 — December 2025. This is the one the auto giant Stellantis data breach lawsuit was about. The complaint alleges that on or around December 25, 2025 a ransomware group breached the systems of FCA US LLC, Stellantis’s U.S. arm, and took roughly 1 terabyte of personal data: names, phone numbers, addresses, dates of birth and Social Security numbers. It alleges Stellantis refused to pay a ransom and the data was published on January 4, 2026. Stellantis has not confirmed those details publicly. The plaintiffs alleged missing basics such as encryption and multi-factor authentication, and cited the September incident to argue the company was already on notice.
Case details
Spadafore v. FCA US LLC, No. 2:26-cv-10214, was filed on January 21, 2026 in the U.S. District Court for the Eastern District of Michigan and assigned to Judge Terrence G. Berg. The defendant is FCA US LLC, doing business as Stellantis North America, headquartered in Auburn Hills, Michigan. The plaintiffs, an Illinois couple who bought a 2023 Jeep Gladiator, pleaded negligence, breach of fiduciary duty, breach of implied contract, unjust enrichment and violation of the Illinois Consumer Fraud and Deceptive Business Practices Act, on behalf of a proposed nationwide class.
Law360 reported on May 20, 2026 that the couple had decided to voluntarily drop the lawsuit, citing a notice in Michigan federal court. No class was certified, so a voluntary dismissal ends their claims, not yours.
A separate federal case, Maloney v. Stellantis Financial Services, Inc., No. 1:26-cv-02459, was filed on September 21, 2026 in the Northern District of Ohio before Judge Bridget Meehan Brennan. The public docket summary does not show what that case is about, and we have not confirmed that it concerns a data breach.
Status: The Breach Case Was Dropped, Nothing Is Payable
Looking for a different Stellantis lawsuit or a recall? The current rearview-camera recall is a safety campaign, not litigation — the latest numbers and owner-letter dates are in our Stellantis recall check.
Who Was Affected
September 2025 incident: North American customers whose contact details sat on the third-party customer-service platform. Stellantis said it was “directly informing affected customers.” It never published a count.
December 2025 incident: the dropped complaint described buyers who gave personal information to FCA US when purchasing a vehicle — the plaintiffs gave theirs when they bought a Jeep. It sought to represent anyone in the United States whose information was accessed. Stellantis has not published an affected-person count for this incident either.
The practical test is your mail. A genuine notice names the incident and the data types involved. Keep it. If you received nothing, that is not proof either way.
Will There Be Money?
For context only: when breach cases involving Social Security numbers do settle, they typically pay documented out-of-pocket losses, a smaller flat payment and credit monitoring. Contact-information-only incidents like the September 2025 one rarely support much of a claim. Our data breach settlement calculator shows how comparable settlements have paid.
How cases like this one end
Our copy of the federal courts’ own case database covers 118,291 other personal injury casesclosed in U.S. federal district courts between 2015 and 2026, 3.9% of them filed as class actions:
- 39.6% ended in a settlement recorded by the court. Another 14% were dismissed voluntarily, which often follows a private settlement — so the real settlement share sits between 39.6% and 53.6%.
- 5.7% were decided on a motion before any trial.
- 1 in 109 reached a trial (0.9%), after a median of 23.9 months.
- Median time from filing to the end of the case: 9 months.
- Only 802 of them (0.7%) record a money award at all; the median of those is $537,500.
These are base rates for this type of case (federal other personal injury cases) — not a prediction about this lawsuit, and not legal advice. Source: Federal Judicial Center, Integrated Database (civil), analysed by Settlement Insight. Cases heard in state courts are not included.
Stellantis Data Breach Timeline
September 21, 2025 — Stellantis Discloses Vendor Breach
Stellantis reports unauthorized access to a third-party platform supporting North American customer service. It says only contact information was involved.
September 22, 2025 — Salesforce Link Reported
BleepingComputer reports the incident is part of a wave of Salesforce data thefts; the attackers claim over 18 million records.
December 25, 2025 — Alleged Ransomware Attack
Per the later complaint, a ransomware group breaches FCA US systems and takes about 1 terabyte of personal data, including Social Security numbers.
January 4, 2026 — Data Allegedly Published
The complaint alleges Stellantis refused the ransom and the stolen data was posted online.
January 21, 2026 — Class Action Filed
Spadafore v. FCA US LLC, No. 2:26-cv-10214, is filed in the Eastern District of Michigan before Judge Terrence G. Berg.
May 20, 2026 — Plaintiffs Drop the Case
Law360 reports the plaintiffs voluntarily dropped the suit. As of October 2026 there is no settlement and no claim form.
Three Things to Watch For
Stellantis itself warned customers about phishing after the September 2025 incident. The leaked contact data is exactly what these schemes use:
“Claim your Stellantis data breach settlement”
There is no settlement and no claims portal. A page or email asking for your Social Security number or VIN to “secure your payment” is collecting data, not filing anything.
Messages that sound like your dealer or Jeep
Attackers with your name, phone and email can pose as Stellantis, a dealer or a recall center. Stellantis told customers to verify communications through official channels — its customer service line is 1 (800) 334-9200.
Fake recall or warranty notices
Real recalls are free and listed by NHTSA under your VIN. A text or call that ties a recall or extended warranty to a fee or a payment link is not from the manufacturer.
Stellantis Data Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
What was the Stellantis data breach?
Two separate incidents. In September 2025 Stellantis disclosed that a third-party customer-service platform was breached and said only contact information was involved. A class action alleges a second, ransomware attack on FCA US around December 25, 2025 that exposed Social Security numbers.
Is the auto giant Stellantis data breach lawsuit still going?
No. Spadafore v. FCA US LLC, No. 2:26-cv-10214 in the Eastern District of Michigan, was voluntarily dropped by the plaintiffs, according to Law360 on May 20, 2026. No class was certified, and we found no replacement case as of October 2026.
Is there a Stellantis data breach settlement or claim form?
No. There is no settlement, no fund, no administrator, no claim form and no deadline for either incident. Anything offering a Stellantis breach payout is not an official claims process.
How much compensation will I get for a data breach?
For the Stellantis incidents: nothing at present, because no case is pending and no settlement exists. In other breach cases that do settle, payments depend on documented losses and on how many people file — use our data breach settlement calculator for comparable figures.
Can I find out if my data has been breached?
For the September 2025 incident, Stellantis said it was directly informing affected customers, so check your mail and email for a notice. Stellantis has not published a count or a lookup tool for either incident. If unsure, call Stellantis customer service at 1 (800) 334-9200 rather than any number in an unexpected message.
What data was exposed?
September 2025: contact information only, per Stellantis. December 2025: the complaint alleged names, phone numbers, addresses, dates of birth and Social Security numbers. Stellantis has not confirmed the December allegations.
Which Stellantis lawsuit is in the news?
For data, the Michigan breach case covered here, now dropped. Stellantis owns 14 brands including Jeep, Ram, Dodge, Chrysler and Fiat, so other Stellantis lawsuit headlines usually concern vehicle defects or recalls — see our Stellantis rearview camera recall page.
What is worth doing right now?
If you bought or financed a Stellantis vehicle and are worried about your Social Security number, freeze your credit at all three bureaus — free and reversible. Treat unexpected calls or texts about your vehicle with suspicion and keep any breach notice you received.
About This Information
- Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated
- $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Salesforce Data Breach LawsuitThe wider wave of thefts from Salesforce customer environments
- Stellantis Rearview Camera RecallSafety recall for Jeep, Ram, Dodge and Chrysler owners, not a lawsuit
- Open Class Action SettlementsSettlements you can still file a claim in
- Data Breach Settlement CalculatorWhat comparable breach settlements have paid per person