Loading story…
Chevin Fleet Solutions declared a major outage after a cybersecurity incident disrupted its FleetWave SaaS platform, prompting the company to take Azure-hosted environments in the UK and US offline as a precaution. The disruption began on April 3 and affected customer access to fleet management services, while Chevin said it engaged external cybersecurity specialists to conduct artifact analysis, threat hunting, and deploy additional security controls before restoring service.
The company has not disclosed the root cause of the incident, the attack method, or whether any customer data was accessed or compromised. Public reporting indicates some FleetWave infrastructure in the EU and Australia remained online, suggesting the incident may have been limited to specific regions or that containment was applied in phases, while customers awaited further guidance on when the affected environments would be confirmed secure and brought back online.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Chevin indicated it would provide an update on restoration timing by April 10 after confirming the affected environment was secure. Reports also noted that some EU and Australian FleetWave infrastructure appeared to remain online during the outage.
Chevin publicly confirmed the disruption on April 3 and said it was working with external cybersecurity specialists on artifact analysis, threat hunting, and additional security controls while investigating the incident. The company did not disclose the root cause or whether customer data had been accessed.
On April 3, 2026, Chevin Fleet Solutions said it proactively took its Azure-hosted FleetWave SaaS environments in the UK and US offline as a precaution following a significant cybersecurity incident, causing a major outage for customers in those regions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Eurofiber France experienced a cyberattack on November 13, 2025, in which threat actors exploited a vulnerability in the company's ticket management platform. The breach resulted in the exfiltration of data related to Eurofiber France and its regional brands, including Eurafibre, FullSave, Netiwan, and Avelia, as well as the cloud division operating under Eurofiber Cloud Infra France. The incident was limited to the French business unit, with no impact on Eurofiber's operations or customers in Belgium, Germany, or the Netherlands. Sensitive information such as banking details and critical data stored in other systems was not compromised, and the vulnerability has since been patched. Following detection, Eurofiber implemented enhanced security measures on the affected platforms and worked with cybersecurity experts to support impacted clients. The company notified all affected customers and reported the incident, which included an extortion-related component, to French authorities CNIL and ANSSI. Operational impact was minimal, with customer-facing services remaining fully functional, and additional steps have been taken to prevent further breaches and strengthen overall system security.
Jun 29, 2026
Autovista has confirmed a ransomware infection affecting its systems in Europe and Australia, disrupting multiple customer-facing applications used by automotive-sector clients. The London-headquartered automotive data and analytics firm said impacted services include tools for residual value monitoring, market trend analysis, and total cost of ownership assessments, and that it has brought in external specialists to help contain and remediate the incident. The company said the investigation is still at an early stage and the initial intrusion vector remains unknown while third-party experts examine the root cause. Autovista has prioritized securely restoring affected applications but has not provided a recovery timeline, and it warned customers that some staff email access has been restricted, advising them to monitor its website for updates and use an alternative company email address for urgent contact.
Jun 29, 2026
Kaseya disclosed a security incident in its **on-premises VSA** remote management platform after attackers exploited a zero-day vulnerability and pushed ransomware through managed service providers to downstream customers. The company ordered on-premises customers to immediately shut down VSA servers, precautionarily took its SaaS infrastructure offline, and said early impact appeared limited to fewer than 40 direct customers, while later estimates put the downstream toll at **800 to 1,500 businesses**. Kaseya said **SaaS customers were not found compromised**, identified VSA as the only affected product, and worked with FireEye Mandiant, the **FBI**, **CISA**, and Emsisoft on containment, forensics, detection tools, hardening guidance, and patches before restoring services. Researchers and media reports linked the campaign to the **REvil** ransomware gang, which used infrastructure associated with prior REvil operations and demanded **$70 million in bitcoin** for a universal decryptor. The attack caused international disruption, most visibly forcing Sweden’s **Coop** grocery chain to close about **800 stores** after payment systems failed, while other Swedish organizations also reported outages. Kaseya later said fewer than 60 direct customers were affected and that it obtained a universal decryptor from a third party on July 21, distributing it with Emsisoft’s help; the company publicly stated it **did not pay a ransom** directly or indirectly to obtain the tool.
Aug 15, 2026