Apparently their site was hacked in another country. I’m not sure whether it affects the website in the USA. I made a payment with a closed checking account in November and it’s marked as payment received which is weird. It should have been rejected.

https://www.securityweek.com/citrixbleed-vulnerability-exploitation-suspected-in-toyota-ransomware-attack/