The iconic Italian luxury car manufacturer, Ferrari, confirmed on Monday that a threat actor had demanded a ransom related to customer contact details that may have been exposed in a ransomware attack. The company stated that the attack did not affect its manufacturing operations, but they have warned customers that personal data including names, addresses, email addresses, and phone numbers, could be at risk. However, Ferrari has found no evidence that financial information and details on owned or ordered cars have been compromised.
In a public statement by Ferrari, the company said, “Upon receipt of the ransom demand, we immediately started an investigation in collaboration with a leading global third-party cyber security firm. In addition, we informed the relevant authorities and are confident they will investigate to the full extent of the law.”
Ferrari did not say when the incident occurred, but many believe it could be related to reports of a ransomware attack in October 2022, when a group called “RansomEXX” claimed it had stolen and leaked 7 GB of data, which Ferrari denied at the time. This ransomware group has been connected to numerous other attacks, including logistics giant Hellmann Worldwide and software and services firm Tyler Technologies, among others.
The company has also stated, “As a policy, Ferrari will not be held to ransom as paying such demands funds criminal activity and enables threat actors to perpetuate their attacks. Instead, we believed the best course of action was to inform our clients and thus we have notified our customers of the potential data exposure and the nature of the incident.”
With Ferrari having one of the most expensive car lineups in the world, the personal information of wealthy customers could be extremely enticing for cybercriminals. This information could also give them the opportunity to customize malicious, targeted emails to these people.
Ferrari assured that the incident has had no impact on day-to-day operations. But this incident serves as a reminder of the growing threat of cyberattacks and the need for individuals and organizations to take robust measures to protect their data.
Find out more:
