Loading story…
Motility Software Solutions, a provider of dealer management software (DMS) to over 7,000 dealerships across the United States, suffered a significant ransomware attack that resulted in the exposure of sensitive personal data belonging to approximately 766,000 individuals. The incident was detected on August 19, 2025, when Motility identified unusual activity within certain computer servers supporting its business operations. Subsequent investigation revealed that an unauthorized actor had deployed malware, encrypting a portion of Motility’s systems and exfiltrating files containing customer data prior to encryption. The compromised data included full names, addresses, email addresses, telephone numbers, dates of birth, Social Security numbers, and driver’s license numbers, with the specific data types varying by individual. Motility’s software is widely used in the automotive, powersports, marine, heavy-duty, and RV retail sectors, making the breach particularly impactful across multiple industries. The Pear ransomware gang claimed responsibility for the attack, and researchers noted that Motility’s parent company, Reynolds & Reynolds, was listed on the group’s leak site. Motility responded by conducting a thorough forensic investigation, restoring impacted systems from backups, and implementing additional security measures to prevent future incidents. The company also established dark web monitoring to detect if the stolen data appears on underground forums, although, as of the latest updates, there was no evidence that the information had been misused. Impacted individuals were notified and offered a year of free credit monitoring and identity protection services. The breach notification was also shared with the Office of the Maine Attorney General, as required by law. Motility urged affected customers to remain vigilant and take protective actions to mitigate the risk of identity theft or fraud. The attack on Motility occurred during a period of heightened cybercriminal activity targeting the insurance and automotive sectors, with other major firms also reporting incidents. The breach underscores the ongoing threat posed by ransomware groups to critical business software providers and the extensive downstream risks to their clients and customers. Motility’s swift response and transparency in disclosing the breach were noted, but the incident highlights the need for robust security controls and regular monitoring in organizations handling large volumes of sensitive personal data. The company’s efforts to update its security posture and provide support to affected individuals are ongoing as the investigation continues.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On October 2, 2025, coverage of the Allianz Life and Motility incidents said the combined toll of the two separate breaches exceeded 2 million people. Allianz Life alone was reported to affect about 1.49 million customers.
By October 2025, reporting said Motility's breach affected 766,670 individuals in the United States. The incident was publicly described as a data breach at the dealership software provider tied to the earlier ransomware attack.
Following the August 2025 intrusion, the Pear ransomware group claimed responsibility for the Motility attack. The group alleged it stole more than 4 TB of data from Motility parent company Reynolds & Reynolds.
In August 2025, dealership software provider Motility was hit by a ransomware attack that led to the theft of personal data. Exposed information reportedly included Social Security numbers and driver's license numbers.
In July 2025, attackers breached a third-party CRM system used by Allianz Life, exposing customer data including names, birthdates, addresses, and Social Security numbers. Reporting linked the intrusion to Scattered Spider's broader campaign targeting Salesforce CRM environments.
4 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcecyber.nj.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Marquis Software Solutions, a provider of marketing and compliance software to over 700 banks and credit unions, experienced a significant data breach after ransomware attackers exploited a vulnerability in its SonicWall firewall. The breach, detected on August 14, allowed attackers to access files containing sensitive information stored by Marquis on behalf of its financial institution clients, potentially exposing the personal data of at least 250,000 individuals. The compromised data may include names, addresses, phone numbers, dates of birth, Social Security numbers, tax identification numbers, and financial account information. Marquis Software stated that the incident was limited to its own environment, but the breach has affected multiple financial institutions whose customer data was managed by the vendor. The company is working with digital forensic investigators to assess the full scope of the breach and has notified affected parties accordingly.
Jun 29, 2026
Volvo North America reported a data breach affecting its employees after a ransomware attack targeted its third-party human resources software provider, Miljödata. The incident began on August 20, 2025, when Miljödata was compromised by the ransomware group DataCarry, which later claimed responsibility and published stolen data on its Tor leak site. Miljödata discovered the attack on August 23, 2025, and after an internal investigation, determined on September 2, 2025, that Volvo Group North America employee data had been impacted. The breach exposed sensitive personal information, including names and Social Security numbers, of current and former Volvo employees. According to notifications sent to affected individuals, Volvo’s own systems were not directly compromised; the breach was limited to data managed by Miljödata. The affected HR systems are used for managing medical certificates, rehabilitation, and work-related injury reporting, and the attack impacted at least 25 organizations, including major companies and hundreds of Swedish municipalities. The total number of affected Volvo employees has not been officially disclosed, but reports suggest it could be several thousand. The data breach notification service Have I Been Pwned indicated that the overall leak from Miljödata involved data from 870,000 accounts, though not all were necessarily Volvo employees. Impacted individuals are at risk of identity theft or fraud due to the exposure of their Social Security numbers. In response, Miljödata engaged cybersecurity experts, enhanced its hosted environment’s security, and is working to prevent future incidents. Volvo notified the Massachusetts Attorney General about the breach, fulfilling regulatory requirements. The breach highlights the risks associated with third-party vendors and the potential for widespread impact when such providers are compromised. Other organizations affected by the Miljödata attack include Scandinavian airline SAS and mining company Boliden. The incident underscores the importance of robust vendor risk management and timely breach notification procedures. DataCarry’s publication of the stolen data increases the urgency for affected individuals to monitor for misuse of their personal information. The breach has drawn attention to the need for improved security controls in HR software platforms used by large enterprises. Volvo’s transparency in communicating the breach to employees and authorities is a critical component of its incident response. The event serves as a reminder of the cascading effects a single ransomware attack on a service provider can have across multiple industries and organizations.
Jun 29, 2026
Ingram Micro disclosed that a **July 2025 ransomware attack** resulted in the theft of files from internal repositories and a subsequent data breach affecting **~42,000 people** (reported as **42,521** in filings). The company said an unauthorized party accessed and exfiltrated certain files between **July 2–3, 2025**, and that it detected the incident on **July 3**, after which it took systems offline and began containment and remediation with external cybersecurity experts and law enforcement notification. The compromised data primarily involved **employee and job applicant records**, including names, contact details, dates of birth, and government-issued identification numbers such as **Social Security**, driver’s license, and passport numbers, as well as some **employment-related information** (e.g., work-related evaluations). The incident also caused significant operational disruption, including outages impacting internal systems and customer-facing operations; reporting noted that **SafePay** claimed responsibility and alleged theft of **~3.5 TB** of data, though Ingram Micro has not publicly attributed the intrusion to a specific threat group while confirming ransomware was deployed.
Jun 29, 2026