Loading story…
Renault UK has notified customers that their personal information may have been compromised following a cyberattack on one of its third-party suppliers. The breach did not affect Renault’s own internal systems, as confirmed by company officials, but rather originated from an external service provider that held customer data. The compromised information includes names, gender, phone numbers, email addresses, postal addresses, vehicle registration numbers, and vehicle identification numbers (VINs). Renault has emphasized that no bank or financial account details were involved in the breach, as the supplier did not store such information. Customers of Renault’s sister brand Dacia have also reportedly received similar notifications, suggesting the breach may have impacted multiple brands under the Renault Group. The company has not disclosed the total number of affected customers or the identity of the breached supplier. Renault has stated that the incident has been contained and that the supplier is taking all appropriate actions to address the breach. The company has reported the incident to relevant regulatory authorities, including the UK Information Commissioner’s Office (ICO), which has confirmed it is making enquiries. Customers have been advised to remain vigilant for unsolicited communications that may attempt to exploit the stolen data for phishing or other malicious purposes. Renault has reassured customers that it will never request passwords or sensitive information via email or phone. The breach highlights the growing risk of supply-chain and third-party attacks in the automotive sector, where attackers increasingly target external vendors to access sensitive data. The incident follows a series of similar breaches affecting other automakers and their suppliers, underscoring the need for robust third-party risk management. Renault’s response has included direct communication with affected individuals, cooperation with the compromised supplier, and engagement with authorities to ensure compliance and transparency. The company has not answered media questions regarding the scale of the breach or the specific nature of the attack. This event serves as a reminder for organizations to assess the security posture of their partners and suppliers, as vulnerabilities in the supply chain can have significant repercussions for customer privacy and brand reputation. The breach has prompted discussions about the adequacy of current security measures in the automotive industry and the importance of timely notification and remediation. Customers are urged to monitor their accounts and communications for signs of identity theft or fraud in the aftermath of the breach.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Subsequent reporting indicated the third-party data breach warning extended to customers of both Renault and Dacia in the UK, broadening the known scope of the incident beyond Renault UK alone.
Renault UK said the incident had been isolated and contained, remediation work was underway, and relevant authorities had been notified in coordination with the affected external provider. The company also warned customers to be alert to phishing or other unsolicited requests for personal information.
Renault UK disclosed that a cyberattack on one of its third-party service providers, not Renault’s internal systems, may have compromised customer personal and vehicle-related data including names, contact details, registration numbers, and VINs. The company said bank and financial account details were not affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
4 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcebleepingcomputer.com
Open sourcescworld.com
Open sourcehackread.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nissan Motor Co. confirmed that personal data of approximately 21,000 customers was compromised following unauthorized access to a Red Hat-managed server. The breach, detected in September, affected customers who purchased vehicles or received services at the former Nissan Fukuoka Motor Co. (now Nissan Fukuoka Sales Co.), exposing names, addresses, phone numbers, partial or full email addresses, and other sales-related customer information. No credit card or financial data was reported stolen, and Nissan has stated there is no evidence the leaked information has been misused, though customers are advised to remain vigilant for potential phishing or fraud attempts. The incident originated from a breach of a dedicated GitLab instance managed by Red Hat Consulting, with the intrusion detected by Red Hat on September 26 and Nissan notified on October 3. The Crimson Collective threat actor initially claimed responsibility for the theft of hundreds of gigabytes of data from 28,000 private GitLab repositories, with ShinyHunters later hosting samples of the stolen data on their extortion platform. Nissan has apologized for the incident and pledged to strengthen monitoring of subcontractors and enhance information security measures in response to the breach.
Jun 29, 2026
Volvo North America reported a data breach affecting its employees after a ransomware attack targeted its third-party human resources software provider, Miljödata. The incident began on August 20, 2025, when Miljödata was compromised by the ransomware group DataCarry, which later claimed responsibility and published stolen data on its Tor leak site. Miljödata discovered the attack on August 23, 2025, and after an internal investigation, determined on September 2, 2025, that Volvo Group North America employee data had been impacted. The breach exposed sensitive personal information, including names and Social Security numbers, of current and former Volvo employees. According to notifications sent to affected individuals, Volvo’s own systems were not directly compromised; the breach was limited to data managed by Miljödata. The affected HR systems are used for managing medical certificates, rehabilitation, and work-related injury reporting, and the attack impacted at least 25 organizations, including major companies and hundreds of Swedish municipalities. The total number of affected Volvo employees has not been officially disclosed, but reports suggest it could be several thousand. The data breach notification service Have I Been Pwned indicated that the overall leak from Miljödata involved data from 870,000 accounts, though not all were necessarily Volvo employees. Impacted individuals are at risk of identity theft or fraud due to the exposure of their Social Security numbers. In response, Miljödata engaged cybersecurity experts, enhanced its hosted environment’s security, and is working to prevent future incidents. Volvo notified the Massachusetts Attorney General about the breach, fulfilling regulatory requirements. The breach highlights the risks associated with third-party vendors and the potential for widespread impact when such providers are compromised. Other organizations affected by the Miljödata attack include Scandinavian airline SAS and mining company Boliden. The incident underscores the importance of robust vendor risk management and timely breach notification procedures. DataCarry’s publication of the stolen data increases the urgency for affected individuals to monitor for misuse of their personal information. The breach has drawn attention to the need for improved security controls in HR software platforms used by large enterprises. Volvo’s transparency in communicating the breach to employees and authorities is a critical component of its incident response. The event serves as a reminder of the cascading effects a single ransomware attack on a service provider can have across multiple industries and organizations.
Jun 29, 2026
Harrods, the renowned London-based luxury retailer, has confirmed a significant data breach affecting 430,000 of its customers after a third-party supplier was compromised by cybercriminals. The company began notifying affected customers on September 26, informing them that their personal data had been accessed during the supplier breach. The stolen data includes basic personal details such as names and contact information, but does not encompass passwords or financial data, according to Harrods' official statements. Some records also contained marketing-related information, including Harrods membership tier levels and affiliations with co-branded cards, though the retailer believes this information would be difficult for unauthorized parties to interpret accurately. Harrods emphasized that its own internal systems were not targeted or compromised in the incident, and the breach was isolated to the unnamed third-party provider. The company has received direct communications from the threat actor responsible for the breach but has stated it will not engage with them. Harrods has reported the incident to all relevant authorities and is cooperating fully with ongoing investigations. The retailer has also reassured customers that the incident is unrelated to a previous cyberattack earlier in the year, which was attributed to the Scattered Spider group. In that earlier event, Harrods successfully blocked the attackers from accessing its systems, while other retailers such as Marks and Spencer and Co-op were also targeted. The current breach was first reported by UK media outlets after Harrods began customer notifications. The company operates a comprehensive e-commerce platform serving international customers, making the exposure of customer data particularly concerning. Harrods has not disclosed the identity of the compromised supplier, citing ongoing investigations and containment efforts. The company’s focus remains on supporting affected customers and maintaining transparency throughout the incident response process. No evidence has been presented to suggest that the compromised data has been used for fraudulent purposes at this time. Harrods has reiterated its commitment to data security and is reviewing its relationships with third-party suppliers to prevent similar incidents in the future. The breach highlights the ongoing risks associated with supply chain security in the retail sector. Customers have been advised to remain vigilant for potential phishing attempts or scams leveraging their exposed information. The incident underscores the importance of robust third-party risk management and timely communication with affected stakeholders.
Jun 29, 2026