Ransomware group 8Base has claimed responsibility for an attack on Volkswagen Group in which it claims to have stolen sensitive data.
Data stolen in the attack allegedly includes invoices, receipts, accounting documents, personal employee files, employment contracts, certificates, personnel records, and numerous confidentiality agreements.
According to 8Base, the attack took place in September 2024, meaning the group has been sitting on a batch of data for more than a year.
Volkswagen has confirmed that a security “incident” occurred, but has so far been tight-lipped on the scope of the incident and whether data has been stolen.
In a statement given to Cybersecurity News, the car manufacturer said there has been no impact on its IT systems, possibly indicating the compromise occurred through a third-party supplier or subsidiary.
Who’s behind the Volkswagen attack?
8Base is a relative newcomer to the threat landscape, having burst onto the scene in 2023. The group is believed to be an offshoot of the Phobos ransomware group, and has reportedly targeted more than 1,000 organizations since forming, netting a total of $16 million in ransom payments.
Often gaining initial access via phishing campaigns or buying credentials on the dark web, the group relies mainly on a strategy of double extortion, encrypting victims' data and threatening to publish stolen information unless a ransom is paid.
Earlier this year, four Russian nationals were arrested in Thailand for alleged involvement in the group, following a joint police operation by 14 countries. The law enforcement sting saw 27 servers linked to the group seized and taken offline.
If confirmed, the Volkswagen attack may represent a change in strategy for the group. Threat intelligence from Europol shows 8Base has tended to focus mainly on small to medium-sized businesses, which often lack the cybersecurity defences to protect themselves.
Previous victims are believed to include a children’s hospital, health care providers, and educational institutions.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- Ransomware victims are refusing to play ball with hackers
- The number of ransomware groups rockets as new players emerge
- The top ransomware trends for businesses in 2025
-
How the AWS outage unfolded, who it impacted, and what it might costNews Apps and websites impacted by the AWS outage have recovered after a highly disruptive start to the week
-
Nvidia CEO Jensen Huang says future enterprises will employ a ‘combination of humans and digital humans’News Enterprise workforces of the future will be made up of a "combination of humans and digital humans," according to Nvidia CEO Jensen Huang. But how will humans feel about it?
-
Cyber experts have been warning about AI-powered DDoS attacks – now they’re becoming a realityNews DDoS attackers are flocking to AI tools and solutions to power increasingly devastating attacks
-
Microsoft issues warning over “opportunistic” cyber criminals targeting big businessNews Microsoft has called on governments to do more to support organizations
-
Europol takes down SIM farm network that scammed thousands of victimsNews The sophisticated operation led to crimes from simple phishing to investment fraud
-
Thousands of exposed civil servant passwords are up for grabs onlineNews While the password security failures are concerning, they pale in comparison to other nations
-
77% of security leaders say they'd fire staff who fall for phishing scams, even though they've done the same thingNews A new report uncovers worrying complacency amongst IT and security leaders
-
Hackers stole source code, bug details in disastrous F5 security incident – here’s everything we know and how to protect yourselfNews CISA has warned the F5 security incident presents a serious threat to federal networks
-
Hackers are using a new phishing kit to steal Microsoft 365 credentials and MFA tokens – Whisper 2FA is evolving rapidly and has been used in nearly one million attacks since JulyNews Whisper 2FA is now the third most common Phishing as a Service tool worldwide
-
Government urges large enterprises to shore up defenses as NCSC warns UK faces four 'nationally significant' cyber attacks every weekNews UK enterprises of all sizes face escalating cybersecurity threats, ministers have warned
