If you have rolled through an Autobell tunnel in the Carolinas, Virginia, Maryland, or Delaware, your first reaction to the phrase “Autobell data breach” was probably to check your credit card statement.
Wrong filing cabinet.
The 2024 cyberattack on the Charlotte-based car wash chain, now headed toward a class action settlement, did not center on the people who buy washes. According to the lawsuit, it hit the people who did the washing: current and former employees, including workers who had already left the company. And the number of people notified tells you something about how long that paperwork had been piling up.
This is not really a story about a car wash getting hacked. It is a story about what a high-turnover employer keeps long after the summer job ends.
What happened at Autobell
Autobell’s own company profile describes it as the largest family-owned car wash company in the country. It was founded in Charlotte in 1969, operates more than 90 locations across five states, employs more than 3,000 people, and washes nearly 5 million cars a year.
On April 7, 2024, the company experienced what its notice letter called a network security incident that “impacted some operations.” A forensic investigation later determined that an unauthorized party may have accessed or taken information from Autobell’s network between April 1 and April 7. That determination came on September 24, 2024. The letters went out October 22, according to the copy of the notice filed with the Vermont Attorney General.
That is 198 days between the day the company knew something was wrong and the day affected people were told. North Carolina’s breach statute, G.S. 75-65, requires notice “without unreasonable delay,” but it also allows time to determine the scope of a breach. Whether six and a half months was reasonable is exactly the kind of question the lawsuit would have tested if it had gone to trial.
The consolidated complaint in Pauken v. Autobell Car Wash, LLC, filed in Mecklenburg County Superior Court, says the notice identified names, Social Security numbers, and bank account and routing numbers among the exposed data. The complaint calls the event a ransomware attack. Autobell’s letter did not use that word. The court-approved settlement notice describes the files as possibly containing names and Social Security numbers.
About 52,714 people received notice.
The number that doesn’t fit
Put those two figures side by side. Autobell says it employs more than 3,000 people. Its breach notice reached more than 17 times that many.
The two named plaintiffs explain the gap. Reece Pauken of Pineville, North Carolina, stopped working for Autobell in 2022, roughly two years before the attack. Jamal Joe of High Point worked there in 2023. Both received letters. The complaint says Pauken’s information, on information and belief, “remains backed up” in the company’s possession.
The court filings do not break down exactly who makes up the 52,714, or how far back the records go. Autobell has not said publicly. But the math points in one direction. A company with a few thousand workers at any given time does not generate more than 50,000 notice letters unless the files reach well into its past.
Now consider who those former workers are. Autobell’s careers page sets the minimum hiring age at 16 and pitches the job to people looking for their first one. Car washes are a classic entry point into the working world: seasonal, physical, and full of teenagers and college students passing through for a summer or two.
That turns a routine HR archive into something much more sensitive. A kid who dried cars for one summer handed over a Social Security number to fill out tax forms and, very often, a bank routing number to get paid by direct deposit. The job ended. The paperwork did not. And a Social Security number, unlike a credit card, cannot be canceled and reissued with a new expiration date.
A car wash is engineered to send the dirt down the drain in about three minutes. The records on the people who work there can sit for years.
How long is an employer supposed to keep this stuff?
There are legitimate reasons to hang on to former employees’ records. The IRS tells employers to keep employment tax records for at least four years after filing the fourth-quarter return for the year. Wage disputes, unemployment claims, and audits all reach backward.
But “at least four years” is a floor, not an instruction to keep everything forever. The Federal Trade Commission’s long-standing data security guide for businesses boils its advice down to five steps, two of which are “scale down” and “pitch it.” Its plainest line: if a business has no legitimate need for sensitive identifying information, it should not keep it.
That is the overlooked issue here. Most businesses think about security as a wall problem: better firewalls, better passwords, better monitoring. The complaint makes those arguments too, alleging that Autobell failed to encrypt data, limit access, and watch for intrusions. Autobell denies all of it. But the size of a breach is decided long before the attacker shows up. It is decided every time a company chooses to keep a record instead of deleting it.
Old data is not an archive. It is inventory for the next thief.
What the settlement actually pays
Special Superior Court Judge Thomas Curr granted preliminary approval on July 8, 2026, calling the deal fair, reasonable, and adequate on a preliminary basis. Under the settlement agreement, anyone who received a breach notice can claim:
- Reimbursement of documented, unreimbursed losses tied to the breach, up to $5,000, with receipts.
- Up to four hours of lost time at $25 an hour, counted inside that $5,000 cap.
- Or, instead of either of those, a flat $45 with no documentation required.
- Two years of three-bureau credit monitoring, available regardless of which cash option a person chooses.
That monitoring offer is double what Autobell first put on the table. The October 2024 notice letter offered 12 months.
Here is the detail most people will skim past: this is a claims-made settlement, not a fixed fund. There is no pot of money that gets divided up. Autobell pays for the claims people actually file. If every one of the 52,714 class members took the $45 option, the payout would come to roughly $2.37 million. If only a small slice files, the cost shrinks accordingly.
Meanwhile, class counsel from Milberg and Federman & Sherwood will ask for up to $350,000 in fees and expenses, and each of the two named plaintiffs will seek a $2,500 service award. Autobell pays those separately, along with the cost of running the settlement. Autobell also agreed to give class counsel a confidential declaration about its cybersecurity practices after the incident and its projected security spending for the next three years. The public does not get to see it.
So the structure has a built-in irony. The lawyers’ number is set. The workers’ number depends on whether a notice reaches people who, by definition, may have moved on from the address they gave a car wash years ago.
The deadlines
Claims must be filed online or postmarked by November 12, 2026, through the official Autobell Data Settlement website. The deadline to opt out or object is October 13, 2026. The final approval hearing is set for November 9, 2026, in Charlotte. No money goes out until the court grants final approval and any appeals are resolved.
Why the car business should pay attention
The auto world has spent the past few years discovering that it is in the data business whether it likes it or not. Dealers are learning that the ID scanners at the showroom door can become their liability. Rental counters only need your driver’s license for a few minutes to create a record that outlives the rental. And the car wash industry’s push toward monthly memberships means more washes keep recurring payment details on file.
The Autobell case is a reminder that the customer database is not always the most valuable target in the building. For a business built on a revolving door of hourly workers, the richest file may be the one in HR: tens of thousands of Social Security numbers belonging to people who haven’t thought about that job in years.
If you ever worked at an Autobell, check your mail and your old email, file a claim before the deadline if you got a notice, and consider a credit freeze. The FTC notes that placing or lifting a freeze costs nothing and doesn’t hurt your credit score.
And if you never worked there, the lesson still applies. Somewhere, an employer from your teenage years probably still has the tax form you filled out on your first day.
Should employers be required to delete former workers’ Social Security numbers after a set number of years, or is that a burden small businesses can’t reasonably carry? Share your take in the comments.