Loading story…
Hyundai AutoEver America, an IT solutions affiliate of Hyundai Motor Group, suffered a cyberattack that compromised its IT environment between February 22 and March 2, 2025. The breach resulted in unauthorized access to sensitive personal information, including names, Social Security numbers, and driver's license details. The company discovered the intrusion on March 1 and immediately launched an investigation with external cybersecurity experts, also notifying law enforcement. The breach notification was confirmed by both the company and the Massachusetts government portal, though the total number of affected individuals and whether employees or customers were impacted remains unclear.
No ransomware group has claimed responsibility for the incident, and there is no evidence yet of data misuse. Hyundai AutoEver America provides IT services for Hyundai and Kia affiliates, supporting vehicle telematics, over-the-air updates, and digital manufacturing platforms. The breach follows a series of cybersecurity incidents affecting Hyundai Motor Group, including ransomware attacks and data exposures in its European operations. The company has not disclosed further details on the extent of the breach or the specific systems compromised.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
Hyundai AutoEver America publicly disclosed that the earlier 2025 cyberattack resulted in a personal data breach. Reporting said the company had not clarified the full scope of affected individuals, and no ransomware group had publicly claimed the intrusion at that time.
Hyundai AutoEver America said an unauthorized party accessed its IT environment between 2025-02-22 and 2025-03-02. The intrusion exposed personal information including names, driver's license data, and Social Security numbers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several U.S. healthcare organizations have disclosed significant data breaches involving unauthorized access to patient and employee information. MedStar Health reported that an unauthorized third party accessed internal systems containing sensitive patient data, including names, dates of birth, Social Security numbers, and medical information. The Rhysida threat group claimed responsibility for this attack, alleging the exfiltration and leak of over 7 million pieces of patient data. Brevard Skin and Cancer Center also confirmed a cyberattack in which the Pear threat group claimed to have stolen 1.8 terabytes of data, affecting both patient and employee records with information such as Social Security numbers, health conditions, and billing details. Both organizations have offered complimentary credit monitoring and identity theft protection to affected individuals and are reviewing their cybersecurity measures. Henry Ford Health in Michigan disclosed an insider data breach affecting nearly 2,000 patients, resulting in the termination of the responsible employee and notification to those impacted. While details on the specific data accessed were not provided, credit monitoring services have been offered. These incidents highlight the ongoing risks faced by healthcare providers from both external threat actors and insider threats, emphasizing the need for robust security policies and continuous evaluation of protective measures to safeguard sensitive health information.
Jun 29, 2026
Volvo North America reported a data breach affecting its employees after a ransomware attack targeted its third-party human resources software provider, Miljödata. The incident began on August 20, 2025, when Miljödata was compromised by the ransomware group DataCarry, which later claimed responsibility and published stolen data on its Tor leak site. Miljödata discovered the attack on August 23, 2025, and after an internal investigation, determined on September 2, 2025, that Volvo Group North America employee data had been impacted. The breach exposed sensitive personal information, including names and Social Security numbers, of current and former Volvo employees. According to notifications sent to affected individuals, Volvo’s own systems were not directly compromised; the breach was limited to data managed by Miljödata. The affected HR systems are used for managing medical certificates, rehabilitation, and work-related injury reporting, and the attack impacted at least 25 organizations, including major companies and hundreds of Swedish municipalities. The total number of affected Volvo employees has not been officially disclosed, but reports suggest it could be several thousand. The data breach notification service Have I Been Pwned indicated that the overall leak from Miljödata involved data from 870,000 accounts, though not all were necessarily Volvo employees. Impacted individuals are at risk of identity theft or fraud due to the exposure of their Social Security numbers. In response, Miljödata engaged cybersecurity experts, enhanced its hosted environment’s security, and is working to prevent future incidents. Volvo notified the Massachusetts Attorney General about the breach, fulfilling regulatory requirements. The breach highlights the risks associated with third-party vendors and the potential for widespread impact when such providers are compromised. Other organizations affected by the Miljödata attack include Scandinavian airline SAS and mining company Boliden. The incident underscores the importance of robust vendor risk management and timely breach notification procedures. DataCarry’s publication of the stolen data increases the urgency for affected individuals to monitor for misuse of their personal information. The breach has drawn attention to the need for improved security controls in HR software platforms used by large enterprises. Volvo’s transparency in communicating the breach to employees and authorities is a critical component of its incident response. The event serves as a reminder of the cascading effects a single ransomware attack on a service provider can have across multiple industries and organizations.
Jun 29, 2026
AssuranceAmerica Managing General Agency disclosed a cyber intrusion that exposed the personal and insurance-related data of up to **6,998,886 individuals** after an unauthorized third party compromised an employee account and accessed parts of the company’s internal network. The company said the malicious activity occurred on March 16, 2026, was detected on March 17, and resulted in copied data files containing names, contact details, automobile insurance policy and account information, driver and vehicle information, and claims records. For some affected people, the exposed data may also include **driver’s license numbers**, **Social Security numbers**, and **Tax ID numbers**. AssuranceAmerica said it completed its forensic review on June 15 and began notifying affected individuals in July, after initially reporting a smaller impact before later filings raised the total to nearly 7 million. In response, the insurer took affected servers offline, isolated impacted systems, disabled compromised credentials, reset passwords, expanded monitoring and threat detection, increased employee cybersecurity training, notified law enforcement, and offered two years of identity protection and credit monitoring through IDX. The company also warned customers to watch for phishing attempts and identity-related fraud.
Jul 14, 2026