Autotrader
January 6, 2023
•[ hack, misconfiguration, automotive ]
In January 2023, 1.4M records from the Autotrader online vehicle marketplace appeared on a popular hacking forum. Autotrader stated that the "data in question relates to aged listing data that was generally publicly available on our site at the time and open to automated collection methods". The data contained 20k unique email addresses alongside physical addresses and phone numbers of dealers and vehicle details including VIN numbers. The data was provided to HIBP by a source who requested it be attributed to "IntelBroker".
Audi
August 14, 2019
•[ leak, misconfiguration, automotive ]
In August 2019, Audi USA suffered a data breach after a vendor left data unsecured and exposed on the internet. The data contained 2.7M unique email addresses along with names, phone numbers, physical addresses and vehicle information including VIN. In a disclosure statement from Audi, they also advised some customers had driver's licenses, dates of birth, social security numbers and other personal information exposed.
Advance Auto Parts
June 5, 2024
•[ leak, misconfiguration, automotive ]
In June 2024, Advance Auto Parts confirmed they had suffered a data breach which was posted for sale to a popular hacking forum. Linked to unauthorised access to Snowflake cloud services, the breach exposed a large number of records related to both customers and employees. In total, 79M unique email addresses were included in the breach, alongside names, phone numbers, addresses and further data attributes related to company employees.
CityBee
February 5, 2021
•[ leak, misconfiguration, automotive ]
In February 2021, the Lithuanian car-sharing service CityBee announced they'd suffered a data breach that exposed 110k customers' personal information. The breach exposed names, email addresses, government issued IDs and passwords stored as unsalted SHA-1 hashes.
Exposed VINs
June 5, 2017
•[ leak, misconfiguration, automotive ]
In June 2017, an unsecured database with more than 10 million VINs (vehicle identification numbers) was discovered by researchers. Believed to be sourced from US car dealerships, the data included a raft of personal information and vehicle data along with 397k unique email addresses.
Royal Enfield
January 1, 2019
•[ leak, misconfiguration, automotive ]
In January 2020, motorcycle maker Royal Enfield left a database publicly exposed that resulted in the inadvertent publication of over 400k customers. The impacted data included email and physical addresses, names, motorcycle information, social media profiles, passwords, and other personal information. The data was provided to HIBP by a source who requested it be attributed to "white_peacock@riseup.net".
DriveSure
December 19, 2020
•[ hack, automotive ]
In December 2020, the car dealership service provider DriveSure suffered a data breach. The incident resulted in 26GB of data being downloaded and later shared on a hacking forum. Impacted personal information included 3.6 million unique email addresses, names, phone numbers and physical addresses. Vehicle data was also exposed and included makes, models, VIN numbers and odometer readings. A small number of passwords stored as bcrypt hashes were also included in the data set.
Gaadi
May 14, 2015
•[ leak, misconfiguration, automotive ]
In May 2015, the Indian motoring website known as Gaadi had 4.3 million records exposed in a data breach. The data contained usernames, email and IP addresses, genders, the city of users as well as passwords stored in both plain text and as MD5 hashes. The site was previously reported as compromised on the Vigilante.pw breached database directory.
Concession Peugeot
December 15, 2024
•[ ransomware, malware, retail ]
Cicada3301 ransomware group claims responsibility for a data breach targeting Concession Peugeot (concessions.peugeot.fr), a prominent French automotive dealership linked to the Peugeot brand. The group claims to have stolen 35GB of sensitive data
Avis
August 3, 2024
•[ leak, automotive ]
American car rental giant Avis notifies over 299,000 customers that unknown attackers breached one of its business applications last month and stole some of their personal information.
ThyssenKrupp
February 23, 2024
•[ ransomware, malware, manufacturing ]
Steel giant ThyssenKrupp confirms that threat actors breached systems in its Automotive division, forcing them to shut down IT systems as part of its response and containment effort. Few days later the company confirms a ransomware attack.
Eagers Automotive
December 24, 2023
•[ ransomware, malware, automotive ]
Eagers Automotive, the largest operator of car dealerships in Australia and New Zealand, announces it suffered a cyberattack and was forced to halt trading on the stock exchange as it evaluates the impact of the incident. The Lockbit ransomware gang claims responsibility for the attack.
Van der Ven Auto's
August 18, 2023
•[ ransomware, malware, automotive ]
Van der Ven Auto's is listed in the Black Basta ransomware site.
K&K Glass
July 31, 2023
•[ hack, automotive ]
K&K Glass, part of Auto Glass Now, files a notice of data breach after discovering that an unauthorized party was able to access the company's IT network.
Gruppo Mercurio
June 2, 2023
•[ ransomware, malware, automotive ]
Gruppo Mercurio, an Italian vehicle transportation company, is hit with a LockBit 3.0 ransomware attack.
Jeff Wyler Automotive Family
May 27, 2023
•[ hack, automotive ]
Jeff Wyler Automotive Family (Jeff Wyler) files a notice of data breach after discovering that an unauthorized party was able to access its computer network.
Automovil Club Argentino
December 1, 2022
•[ hack, automotive ]
Automovil Club Argentino posted a notice on its Facebook account that it suffered a network intrusion on December 1st.
Feu Vert
December 6, 2022
•[ ransomware, malware, automotive ]
Vice Society encrypted and leaked data stolen from Feu Vert onto their dark web site
UnitedAuto
November 25, 2022
•[ leak, automotive ]
LV adds UnitedAuto, a Mexican automotive company, to its leak site, claiming to have more than 2TB of stolen personal information.
Ethos Group
October 31, 2022
•[ leak, misconfiguration, automotive ]
Ethos Group announces that the company recently experienced a data breach impacting the security of consumer information stored on its computer systems.
