Loading story…
Autovista has confirmed a ransomware infection affecting its systems in Europe and Australia, disrupting multiple customer-facing applications used by automotive-sector clients. The London-headquartered automotive data and analytics firm said impacted services include tools for residual value monitoring, market trend analysis, and total cost of ownership assessments, and that it has brought in external specialists to help contain and remediate the incident.
The company said the investigation is still at an early stage and the initial intrusion vector remains unknown while third-party experts examine the root cause. Autovista has prioritized securely restoring affected applications but has not provided a recovery timeline, and it warned customers that some staff email access has been restricted, advising them to monitor its website for updates and use an alternative company email address for urgent contact.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Autovista said it brought in external support and third-party experts to help contain, remediate, and investigate the ransomware infection. The company also restricted some staff email access and directed customers to use its website and an alternative email address for urgent contact while services are restored.
Autovista publicly acknowledged a ransomware incident affecting its systems in Europe and Australia. The company said multiple customer-facing applications used for residual value monitoring, market analysis, and total cost of ownership assessments were disrupted.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcego.theregister.com
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Bajaj Auto disclosed that a ransomware attack affected systems at both the parent company and its wholly owned subsidiary, Bajaj Auto Technology Ltd. The company said the incident was detected at about 8:00 AM IST and that internal technical teams, external cybersecurity specialists, and management launched containment and mitigation measures immediately. Bajaj Auto also notified **CERT-In** under the Information Technology Act, 2000, and reported the incident under **SEBI Regulation 30**. The manufacturer said the response had so far limited the impact, but it did not say whether data was exfiltrated or whether manufacturing, supply chain, or other business operations were materially disrupted. Investor reaction was negative after the disclosure, with Bajaj Auto shares falling more than 2%, underscoring the market sensitivity around ransomware incidents affecting major industrial and automotive firms.
Jun 29, 2026
Kaseya disclosed a security incident in its **on-premises VSA** remote management platform after attackers exploited a zero-day vulnerability and pushed ransomware through managed service providers to downstream customers. The company ordered on-premises customers to immediately shut down VSA servers, precautionarily took its SaaS infrastructure offline, and said early impact appeared limited to fewer than 40 direct customers, while later estimates put the downstream toll at **800 to 1,500 businesses**. Kaseya said **SaaS customers were not found compromised**, identified VSA as the only affected product, and worked with FireEye Mandiant, the **FBI**, **CISA**, and Emsisoft on containment, forensics, detection tools, hardening guidance, and patches before restoring services. Researchers and media reports linked the campaign to the **REvil** ransomware gang, which used infrastructure associated with prior REvil operations and demanded **$70 million in bitcoin** for a universal decryptor. The attack caused international disruption, most visibly forcing Sweden’s **Coop** grocery chain to close about **800 stores** after payment systems failed, while other Swedish organizations also reported outages. Kaseya later said fewer than 60 direct customers were affected and that it obtained a universal decryptor from a third party on July 21, distributing it with Emsisoft’s help; the company publicly stated it **did not pay a ransom** directly or indirectly to obtain the tool.
Aug 15, 2026
**Advantest Corporation** reported a cybersecurity incident in which an unauthorized party appears to have accessed parts of its network and **deployed ransomware**, impacting certain internal systems. The company said it detected unusual activity on **Feb. 15 (JST)**, activated incident response procedures, **isolated affected systems**, and engaged third-party cybersecurity specialists to support investigation and containment; the investigation remains ongoing and findings may change as more facts are confirmed. Public reporting echoed Advantest’s statement that the scope and responsible ransomware group are **not yet identified**, and noted the broader trend of increased ransomware targeting of industrial and manufacturing organizations, including the semiconductor sector. Advantest stated it will provide updates and, if the investigation determines **customer or employee data** was affected, it will notify impacted individuals directly with guidance on protective measures.
Jun 29, 2026