Kde
November 4, 2026
•[ ransomware, technology, manufacturing ]
Kde was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Technology. Moroccan industrial/automotive company (icn.ma) with a full in-house accounting office: general-ledger and cash-desk files, client balances, bank transfer orders (BMCE), purchase orders, staff lists, and trade documents including an overseas distribution agreement and proforma invoices for FAS Automotive (encap_maroc).
Karl Chevrolet, Inc. (d/b/a Karl Auto Group)
April 3, 2026
•[ ransomware, leak, retail ]
An unauthorized third party gained access to certain Karl Auto Group computer systems before 2026-03-27. RansomHouse later claimed that it encrypted Karl Chevrolet systems on 2026-04-03, but Karl Auto Group did not publicly confirm the attribution or ransomware deployment. The company discovered the incident on 2026-04-04, when employees encountered unavailable phones and computers. Phone service remained disrupted or intermittent through at least 2026-04-08, although dealerships remained open and directed customers to email, online messages, or in-person service. Karl Auto Group stated that files containing personal information belonging to current and former customers, employees, and other individuals may have been accessed; thousands of customers were notified, but the total number affected was not disclosed. The company reported no evidence of misuse and said it did not pay a ransom.
Karl Auto Group
April 4, 2026
•[ ransomware, automotive ]
Karl Auto Group discovered unauthorized access to certain business computer systems on April 4, 2026 after access had begun before March 27. Employees at multiple Iowa dealerships lacked working phones and computers, and phone service remained unavailable or intermittent for at least five days, although locations remained open. The company stated that files containing customer and employee information may have been accessed. RansomHouse separately claimed that Karl Chevrolet was encrypted on April 3, but Karl Auto Group did not confirm ransomware, data theft, or a connection to the group.
Nissan North America, Inc.
May 27, 2026
•[ hack, leak, automotive ]
Between May 27 and June 9, 2026, attackers exploited CVE-2026-35273, a previously unknown vulnerability in Oracle PeopleSoft, and accessed Nissan North America's employee-information environment. Nissan stated that information belonging to current and former employees in the United States, Canada, Mexico, and Brazil may have been stolen. Reporting linked the broader PeopleSoft campaign to ShinyHunters, but Nissan did not publicly attribute its incident to the group.
United Auto Supply
June 5, 2026
•[ ransomware, leak, retail ]
WorldLeaks publicly listed United Auto Supply on June 5, 2026 as part of its data-theft extortion operation. Independent ransomware monitoring captured the same June 5 claim, and DataBreach.com subsequently indexed 826,018 records containing personal, contact, and vehicle information associated with the company. United Auto Supply has not publicly confirmed the incident, and no operational disruption has been independently established.
Wilbert's Family Enterprises
July 27, 2026
•[ ransomware, leak, automotive ]
Qilin claimed responsibility for an attack on Wilbert's on July 27, 2026 and threatened to release company data unless a settlement was reached. DataBreach.com indexed 106,010 leaked rows containing contact information and vehicle identification numbers. Qilin also claimed that company data had been encrypted, but no independent source has confirmed operational disruption. Wilbert's operates automotive recycling facilities and supplies recycled auto parts from its Webster, New York headquarters and other locations.
Hyundai Motor Türkiye Otomotiv AŞ
August 1, 2026
•[ sqlinjection, leak, automotive ]
An attacker exploited a SQL injection vulnerability in a web application used by Hyundai Motor Trkiye, obtaining personal data belonging to employees and job applicants. Hyundai detected the breach on August 1, 2026, and its data processor confirmed it on August 3. CRPx0 later claimed Hyundai among its victims and offered associated data for sale; the claimed assessment data is consistent with the categories disclosed to Trkiye's data protection authority.
DIPECARR
October 8, 2026
•[ ransomware, retail, automotive ]
DIPECARR was listed as a victim on the leak site of the Eclipse ransomware group; the attack is estimated to have taken place on 2026-10-08. Sector: Other. Country: Brazil. Website: www.dipecarr.com.br. Dipecarr is Brazil's top truck parts distributor, founded in 1994 by Adilson Jos de Almeida. With over 10,000 items ready to ship and partnerships with world-known brands, they serve 80,000 customers across seven branches in key Brazilian states. The company offers everything a truck owner needs, focusing on quality service and continuous growth.
Machine sro
October 6, 2026
•[ ransomware, manufacturing, automotive ]
Machine sro was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: Czechia. Website: k2machine.cz. k2machine.cz zoominfo.com/c/machine-sro/537154777 K2 Machine s.r.o. is a private Czech industrial machinery manufacturer founded in 2011 in Pardubice, Czech Republic, growing from 3 founders in a small office to ~2550 employees and 400+ completed projects over 15 years. Annual turnover is 100+ million CZK (~4M), though 2024 saw a sharp 18.7% revenue decline (operating revenue 27.7%). The company designs and builds special-purpose machines, automated production lines, robotic cells (including 3D Bin Picking), conveyor systems, and performs CNC machining, equipment repowering, and line relocation serving primarily the automotive and consumer industries. Its full-cycle capability spans Solid Edge 3D design, EPLAN electrical engineering, CNC production, assembly, commissioning, and after-sales service under one roof at its own Semtn campus (since 2020).
ConAuto
October 12, 2026
•[ ransomware, automotive ]
ConAuto was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: Ecuador. Website: www.conauto.com.ec.
Aeroklas Duys / Duys Engineering Group
October 12, 2026
•[ ransomware, manufacturing, automotive ]
Aeroklas Duys / Duys Engineering Group was listed as a victim on the leak site of the Deadlock ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Manufacturing. Country: South Africa. Website: aeroklasduys.co.za. Aeroklas Duys (Pty) Ltd a specialized automotive manufacturing company It was formed as a strategic joint venture between the Duys Engineering Group and Aeroklas (a prominent global automotive accessory manufacturer owned by the Eastern Polymer Group of Thailand). Duys Engineering Group an industrial and mechanical engineering firm founded in South Africa in 1960.
Torns Enterprises
October 14, 2026
•[ ransomware, manufacturing, energy ]
Torns Enterprises was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-14. Vicente Torns is a leading industrial group specializing in the manufacturing of electrical con
ductors for the energy, automotive, and construction sectors. The company transforms copper and
aluminum for use in the electrical sector, offering a wide range of products including encased
strips, twisted cables, and polyimide.
We will upload 84gb of corporate data soon. Employee information (passports, visa docs, complet
e forms and other HR files), client information, contracts and agreements, confidential files,
financial papers, NDA, etc.
TGM Manufacturing, Inc
October 15, 2026
•[ ransomware, manufacturing, automotive ]
TGM Manufacturing, Inc was listed as a victim on the leak site of the Wallstreet ransomware group; the attack is estimated to have taken place on 2026-10-15. Sector: Manufacturing. Country: United States of America. TGM Manufacturing provides machining services, including automobile machine-shop work.
Company #94
October 19, 2026
•[ ransomware, automotive, retail ]
Company #94 was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-19. Country: United States of America. automotive retail United States | [PENDING EXPOSURE]
MECA-PRECIS
October 21, 2026
•[ ransomware, manufacturing, automotive ]
MECA-PRECIS was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-10-21. Sector: Manufacturing. Country: France. Website: mecaprecis.com. Mca-Prcis is a French industrial manufacturer specializing in precision stamping dies, sheet metal stamping, and metal component production. It serves the automotive, construction, and home appliance industries, offering custom tooling
Performance Ford Inc
October 22, 2026
•[ ransomware, retail, automotive ]
Performance Ford Inc was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-22. Sector: Retail & E-Commerce. Country: United States of America. automotive retail United States | Network security configuration of an automotive retailer; Private network tunnel definitions between locations; Internal network maps and device inventory | [NOT PAID EXPOSED]
Toyota Canarias
October 19, 2026
•[ ransomware, automotive ]
Toyota Canarias was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-19. Sector: Transportation. Country: Spain. Website: www.toyota-canarias.es.
Bi Link
October 31, 2026
•[ ransomware, manufacturing, technology ]
Bi Link was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-31. Country: United States of America. Website: bi-link.com. bi-link.com Revenue $380.2 Million Bi-Link US precision manufacturer founded in 1961 (HQ Bloomingdale, IL), making metal stampings and injection-molded plastics with in-house tooling and assembly for automotive, medical, wireless, and consumer electronics OEMs. It owns plants in Shanghai, Nanning, Mexico (Jurez), and a new Vietnam site (2024), offering prototype-to-production under one roof. Revenue isn't reliably public broker estimates range wildly from ~$10M to $50M, but a TaiPEX filing suggests ~$5M+/month after consolidation. The critical development: in October 2025 family owners agreed to sell the company to Taiwan-listed Donpon Precision, closed and consolidated from Jan 2026. Despite the site still claiming "family-owned", control is now Donpon's, and long-time CEO Tom Harris has exited. Certifications (ISO 9001, ISO 13485, IATF 16949) support real OEM work (e.g. Teleflex via a 3D Systems case)
Lydenburg Toyota
October 26, 2026
•[ ransomware, retail, manufacturing ]
Lydenburg Toyota was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Retail & E-Commerce. Country: South Africa. Website: lydenburg.toyota.co.za. lydenburg.toyota.co.za Lydenburg Toyota is a Toyota dealership in Lydenburg (Mashishing), Mpumalanga, South Africa, part of the Toyota South Africa Motors dealer network selling new Toyota and Lexus vehicles, certified used cars, service, parts and financial services. The town is also home to Toyota SA Manufacturing, the largest Toyota plant in Africa, assembling Hilux, Fortuner and Corolla Cross with engines and components exported to over 40 countries including the United States. Toyota SA Motors holds 24.2 percent of the South African vehicle market and exported 187 billion rand in FY2023, with 8500 direct employees across its plants. The company invested 2.43 billion rand in hybrid technology and is developing a 2.2 billion dollar Mbombela megaproject including housing, schools and hospitals around the Lydenburg plant. Corolla Cross production from Lydenburg began exports to the US in April 2024.
