Final statement re PSA
September 24, 2026
•[ hack, ransomware, automotive ]
Final statement re PSA was listed as a victim on the leak site of the shinyhunters ransomware group; the attack is estimated to have taken place on 2026-09-24. Good afternoon, We have no further comments to make regarding our PSA statement we released the other day. Our organisation is highly confident we have achieved our goal and our intentions we repeatedly made clear to journalists and in our public statements. There is 5 days remaining still. We have no comment yet regarding what we will do if the victim entity does not comply with our kind request . Nonetheless, we got what we wanted and we have a business to run and operate as usual. We will not be responding to any press inquiries about this and we will not be sharing updates about other datasets we have that we did not yet disclose to the public. We reiterate and want to assiduously emphasise we are NOT extorting the victim in question, this is NOT financially motivated and this is NOT a ransom. Thank you for your time and attention to this matter. This is now old news. Regards, SH | Updated: 24 Sep 2026
Grupo MARSAN
September 21, 2026
•[ ransomware, manufacturing, automotive ]
Grupo MARSAN was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Manufacturing. Country: Mexico. Website: grupomarsan.com. grupomarsan.com zoominfo.com/c/grupo-marsan/460771135 Grupo Marsan is a Spanish Tier 2 automotive supplier founded in 1951 in Vigo, Spain, specializing in industrial surface coatings cataphoresis (e-coating), powder and liquid painting plus metal stamping, assembly, and JIT logistics, with a capacity of 300,000 parts per day. The company operates plants in Spain (Vigo, Zaragoza), Portugal, and Mexico, and also builds and runs dedicated in-house coating lines inside clients' facilities, supported by its own technology center M-Tech. It works under IATF automotive quality standards within supply chains of major OEMs and Tier 1 suppliers. After a liquidity crisis in 2024, the group was recapitalized with private and Galician public funds (~47.5% held by Xesgalicia and Vigo Activo), and Marcos Oubia was appointed CEO. FY2024 revenue exceeded 28 million with ~450 employees, and in 2025 the company acquired KATA Aragn, growing to ~500 employees
Auto Holler
September 29, 2026
•[ ransomware, retail, automotive ]
Auto Holler was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Retail & E-Commerce. Country: Austria. Website: autohoeller.at. autohoeller.at zoominfo.com/c/auto-holler/431018598 Auto Hller (family business founded 1968 by Erwin and Monika Hller as a small filling station in Seekirchen) is a multi-brand car dealership and workshop in Eugendorf near Salzburg, Austria, employing 32 staff across two locations. It is an official long-standing dealer for Kia (top-5 Kia partner in Austria), Mazda (one of the largest in western Austria) and Isuzu commercial vehicles, selling new, young ("HLLISCH GUT" certified) and used cars plus fleet management, financing and a full-service workshop with body shop and 57a inspection station. Since 2006 it has been led by the founder's son Markus Hller (sole owner across three legal entities: GmbH, GmbH & Co KG and an Immobilien company), with total assets of 5.7M as of end-2024. The dealership is locally famous for its humor-driven marketing ("Hllisch gut" branding, cabaret evenings)
DBM Reflex
May 13, 2026
•[ ransomware, manufacturing, technology ]
DBM Reflex was listed as a victim on the leak site of the Orova ransomware group; the attack is estimated to have taken place on 2026-05-13. Sector: Other. Country: Taiwan. Website: dbmreflex.com.tw. DBM Technology Co., Ltd. is a leading brand in electroforming mold cores in Asia, established in 1999. With a team of over 70 professionals, the company specializes in mold core design and high-quality electroformed mold production, having produced more than 9,000 sets to date. Their services include feasibility assessments, optical design, mold core structure design, product testing, and light distribution testing, making them a preferred choice in the automotive industry.
Al-Futtaim Group
July 21, 2026
•[ ransomware, retail, automotive ]
Al-Futtaim Group was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-07-21. Sector: Retail & E-Commerce. Country: United Arab Emirates. Website: alfuttaim.com. [AI generated] Al-Futtaim Group is a diversified conglomerate headquartered in Dubai, United Arab Emirates. Founded in the 1930s, it operates across retail, automotive, real estate, and financial services sectors. The group represents major global brands including IKEA, Toyota, and Marks & Spencer across the Middle East, Africa, and Asia. It is one of the region's most prominent privately held business enterprises.
Long-Lewis Automotive Group
August 4, 2026
•[ ransomware, automotive, financial ]
Long-Lewis Automotive Group was listed as a victim on the leak site of the Dark Project ransomware group; the attack is estimated to have taken place on 2026-08-04. Country: United States of America. Website: www.longlewis.com. About Long-Lewis Automotive Group The Long-Lewis Auto Group is Alabamas largest automotive retailer, with origins tracing back to a hardware store founded in Bessemer, Alabama, in 1887. It became one of the nation's very first Ford dealerships in 1915 and operates multiple dealerships across the state. Following a successful cyberattack on Long Lewis, more than 500 GB of confidential information was stolen. More than 15,000 records containing personal data of the organizations customers and employees, important financial and banking documents, and other valuable company information were compromised. Currently, Long Lewis lost control of more than 650,000 files.
David King Architect
August 6, 2026
•[ ransomware, manufacturing, healthcare ]
David King Architect was listed as a victim on the leak site of the Orova ransomware group; the attack is estimated to have taken place on 2026-08-06. Sector: Professional Services. Country: United States of America. Website: www.mapquest.com/us/florida/david-king-architect-427495503. We are an Architectural Firm and Design and prepare plans for almost any low rise structure. We have designed Assisted Living Facilities, Offices, Warehouses, manufacturiing facilities and Car dealerships.
www.hymiasa.com
August 7, 2026
•[ ransomware, manufacturing, automotive ]
www.hymiasa.com was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-08-07. Sector: Other. Country: Peru. Website: www.hymiasa.com. HYMIASA (Hules y Mangueras Industriales y Automotrices, S.A. de C.V.) is a Mexican leading company specialized in fluid ...
Ponti
August 6, 2026
•[ ransomware, automotive ]
Ponti was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-08-06. Sector: Other. Country: Poland. Website: ponti.pl. ponti.pl Ponti is a specialized automotive company based in Gdask, Poland, focused on the direct import, sales, and professional servicing of American vehicles. Operating as a leading expert in the US car market, the company handles everything from modern everyday models to the restoration of classic muscle cars and vintage vehicles. They provide a comprehensive range of services, including sourcing, repairing post-accident imports, and dedicated mechanical maintenance for automotive enthusiasts
OTEGROUP
August 1, 2026
•[ ransomware, automotive, retail ]
OTEGROUP was listed as a victim on the leak site of the blacknevas ransomware group; the attack is estimated to have taken place on 2026-08-01. Sector: Other. Country: Oman. Website: otegroup.com. OTE Group, founded in 1991, is one of Oman's leading business groups and part of Saad Bahwan Holding a family-run enterprise and one of the oldest and largest privately owned business houses in Oman, with interests in over 15 industries and 30+ companies across the Gulf region.Starting as a small, one-franchise business, OTE Group has grown into a diversified powerhouse operating in 14 industries across 4 countries Oman, UAE, Saudi Arabia, and Algeria with 200+ customer touchpoints, and continued expansion underway.The group's core business spans automotive (exclusive distributor for brands like Cadillac, Chevrolet, Hyundai, Isuzu, Subaru, and GWM), electronics and home appliances, and polymer color concentrates for the plastics industry, alongside historical interests in auto parts, lubricants, tires, batteries, vehicle leasing, and vocational training. The company credits its growth to collaboration, cross-cultural understanding, and talent development.
Lucidmotors
August 4, 2026
•[ ransomware, automotive, technology ]
Lucidmotors was listed as a victim on the leak site of the Sovcali ransomware group; the attack is estimated to have taken place on 2026-08-04. Sector: Transportation. Country: United States of America. Website: lucidmotors.com. Lucid Motors & eShocan Engineering Archive in Our Possession. The complete engineering archive of Lucid Motors and eShocan is now available: 5.078 terabytes of CATIA and STEP models, FEA and NVH analyses, multi-gigabyte CFD simulations of the LiDAR washing system, topology optimization studies, static and modal results for the Gravity and Midsize enclosures, BOMs, and internal progress reports.
G.M.A. GRANDI MARCHE AUTOMOBILI - S.R.L
August 11, 2026
•[ ransomware, automotive ]
G.M.A. GRANDI MARCHE AUTOMOBILI - S.R.L was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-08-11. Sector: Transportation. Country: Italy. Website: autogma.it.
IRCO.COM
August 5, 2026
•[ ransomware, manufacturing, automotive ]
IRCO.COM was listed as a victim on the leak site of the clop ransomware group; the attack is estimated to have taken place on 2026-08-05. Country: Iran. Website: IRCO.COM. Data exfiltrated included the following: Cad-files, PDF drawings, diagrams, product presentations, specifications, manuals and instructions Total size: 5564Gb Revenue: $7,800,000,000
Tianji Auto Care Service Company
August 5, 2026
•[ ransomware, automotive ]
Tianji Auto Care Service Company was listed as a victim on the leak site of the nightspire ransomware group; the attack is estimated to have taken place on 2026-08-05. Sector: Transportation. Country: Turkey.
Standard Tool & Die
August 17, 2026
•[ ransomware, manufacturing, automotive ]
Standard Tool & Die was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-08-17. Sector: Manufacturing. Country: United States of America. Website: standardtool.net. Standard Tool & Die specializes in designing and manufacturing die cast dies, plastic molds, and trim dies for various industries including automotive, appliance, furniture, and household goods. The company offers single source manufacturing solutions and focuses on precision machining for both domestic and international clients. They are committed to developing cost-effective and time-saving strategies while continually investing in advanced equipment. Standard Tool aims to provide effective solutions to industry challenges through innovative design and strategic thinking.
The company headquarters is located in 2950 Johnson Road, Stevensville, MI 49127, United States. 51-200 Employees
Sharp Motor Group
August 23, 2026
•[ ransomware, automotive ]
Sharp Motor Group was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-08-23. Sector: Transportation. Country: Australia. Website: sharpmotorgroup.com.au. Sharp Motor Group is a privately owned automotive dealership group based in Tweed Heads, New South Wales, Australia. The company serves customers across Tweed Heads, the Northern Rivers region, and the Gold Coast. Sharp Motor Group sells new, used, and demonstrator vehicles and provides vehicle servicing, spare parts, finance, insurance, and trade-in services. Its dealership represents major automotive brands, including Kia, Suzuki, Mahindra, Chery, Renault, and GMSV. The company focuses on providing a convenient one-stop automotive service and emphasizes customer service, value, choice, and a positive buying and ownership experience.
The company headquarters is located in 153 Wharf Street, Tweed Heads, NSW 2485, Australia. 51-200 Employees
Johnson City Honda
August 25, 2026
•[ ransomware, retail, automotive ]
Johnson City Honda was listed as a victim on the leak site of the Global Secret Group ransomware group; the attack is estimated to have taken place on 2026-08-25. Sector: Retail & E-Commerce. Country: United States of America. Website: johnsoncityhonda.com. Country: Tennessee, United States |
Website: johnsoncityhonda.com |
Revenue: $6,5 Million |
Industry: Automobile Dealers |
Employees: 11-50 |
Properties: 32.9 GB(34,277 Files, 8,896 Folders)
i-one
August 28, 2026
•[ ransomware, manufacturing, automotive ]
i-one was listed as a victim on the leak site of the Black X ransomware group; the attack is estimated to have taken place on 2026-08-28. Country: South Korea. Website: www.i-one.co.kr. This company is a manufacturer of car parts. We have obtained all of your company's technical data. (1TByte) If you do not contact us, all your data, including technical, sales, drawings, quality, logistics, and supply chain information, will be leaked.
ESB Puerto Rico Corp
August 28, 2026
•[ ransomware, energy, automotive ]
ESB Puerto Rico Corp was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-08-28. Sector: Energy & Utilities. Country: Puerto Rico. Website: esbpr.com. esbpr.com ESB Puerto Rico Corp is a distributor of automotive and industrial products that has served Puerto Rico since 1965 ("Energizando a Puerto Rico desde 1965"); it is headquartered in Carolina, PR, is a Hispanic-/minority-owned small business and a federal contractor (CAGE 3DPU1). Its portfolio spans automotive, traction and stationary/backup batteries, tires, lubricants and DEF, AUTEL diagnostics, tools, plus Hyundai and EP forklifts, warehouse equipment, rental, maintenance, OEM parts and e-commerce a "one-stop source" for material handling, automotive and industrial operations in Puerto Rico and the Virgin Islands, representing ~9 brands (including Eternity Technologies). The president is Omar Aponte; the company stays lean (under ~25 staff, ~$2M revenue) and handles ~150 sea import shipments a year, mostly from Asia.
EP Manufacturing Bhd
August 31, 2026
•[ ransomware, manufacturing, automotive ]
EP Manufacturing Bhd was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-08-31. Sector: Manufacturing. Country: Malaysia. Website: epmb.com.my. epmb.com.my zoominfo.com/c/ep-manufacturing-bhd/372140192 EPMB (7773, Bursa Malaysia) Malaysian auto manufacturer, operating since 1982.
Formerly made parts for Proton, Perodua, Honda, Toyota.
Now assembles complete cars in Melaka for Chinese brands: GWM, BAIC, XPENG, MG.
Capacity raised to 30,000 vehicles/year; in 2026 output exceeds 1,000 cars/month.
Q2 2026: net profit RM5.15m (19 up), revenue RM212.7m (+67%) 10-year record.
Share price ~RM0.44, market cap ~RM125m, dividend ~1.2%; risks debt and low liquidity.
