Volkswagen confirms security ‘incident’ amid ransomware breach claims
The 8Base group claims to have accessed sensitive Volkswagen data, but the company insists no IT systems have been impacted
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
You are now subscribed
Your newsletter sign-up was successful
Ransomware group 8Base has claimed responsibility for an attack on Volkswagen Group in which it claims to have stolen sensitive data.
Data stolen in the attack allegedly includes invoices, receipts, accounting documents, personal employee files, employment contracts, certificates, personnel records, and numerous confidentiality agreements.
According to 8Base, the attack took place in September 2024, meaning the group has been sitting on a batch of data for more than a year.
Volkswagen has confirmed that a security “incident” occurred, but has so far been tight-lipped on the scope of the incident and whether data has been stolen.
In a statement given to Cybersecurity News, the car manufacturer said there has been no impact on its IT systems, possibly indicating the compromise occurred through a third-party supplier or subsidiary.
Who’s behind the Volkswagen attack?
8Base is a relative newcomer to the threat landscape, having burst onto the scene in 2023. The group is believed to be an offshoot of the Phobos ransomware group, and has reportedly targeted more than 1,000 organizations since forming, netting a total of $16 million in ransom payments.
Often gaining initial access via phishing campaigns or buying credentials on the dark web, the group relies mainly on a strategy of double extortion, encrypting victims' data and threatening to publish stolen information unless a ransom is paid.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
Earlier this year, four Russian nationals were arrested in Thailand for alleged involvement in the group, following a joint police operation by 14 countries. The law enforcement sting saw 27 servers linked to the group seized and taken offline.
If confirmed, the Volkswagen attack may represent a change in strategy for the group. Threat intelligence from Europol shows 8Base has tended to focus mainly on small to medium-sized businesses, which often lack the cybersecurity defences to protect themselves.
Previous victims are believed to include a children’s hospital, health care providers, and educational institutions.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- Ransomware victims are refusing to play ball with hackers
- The number of ransomware groups rockets as new players emerge
- The top ransomware trends for businesses in 2025
Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.
-
Salesforce targets telco gains with new agentic AI toolsNews Telecoms operators can draw on an array of pre-built agents to automate and streamline tasks
-
Four national compute resources launched for cutting-edge science and researchNews The new national compute centers will receive a total of £76 million in funding
-
Using AI to generate passwords is a terrible idea, experts warnNews Researchers have warned the use of AI-generated passwords puts users and businesses at risk
-
Researchers called on LastPass, Dashlane, and Bitwarden to up defenses after severe flaws put 60 million users at risk – here’s how each company respondedNews Analysts at ETH Zurich called for cryptographic standard improvements after a host of password managers were found lacking
-
‘They are able to move fast now’: AI is expanding attack surfaces – and hackers are looking to reap the same rewards as enterprises with the technologyNews Potent new malware strains, faster attack times, and the rise of shadow AI are causing havoc
-
Ransomware gangs are using employee monitoring software as a springboard for cyber attacksNews Two attempted attacks aimed to exploit Net Monitor for Employees Professional and SimpleHelp
-
Ransomware gangs are sharing virtual machines to wage cyber attacks on the cheap – but it could be their undoingNews Thousands of attacker servers all had the same autogenerated Windows hostnames, according to Sophos
-
Google issues warning over ShinyHunters-branded vishing campaignsNews Related groups are stealing data through voice phishing and fake credential harvesting websites
-
Notepad++ hackers remained undetected and pushed malicious updates for six months – here’s who’s responsible, how they did it, and how to check if you’ve been affectedNews Hackers remained undetected for months and distributed malicious updates to Notepad++ users after breaching the text editor software – here's how to check if you've been affected.
-
CISA’s interim chief uploaded sensitive documents to a public version of ChatGPT – security experts explain why you should never do thatNews The incident at CISA raises yet more concerns about the rise of ‘shadow AI’ and data protection risks
