Loading story…
Škoda disclosed that attackers exploited a vulnerability in its online shop software, gaining temporary unauthorized access to the e-commerce environment and prompting the company to take the shop offline. The automaker said the affected system processes customer names, addresses, contact details, order information, and login credentials, and that passwords were stored as cryptographic hashes. Škoda notified the relevant data protection authority, remediated the flaw, and brought in a specialized IT forensics team to investigate the incident.
The company said technical analysis indicates access to data stored in the shop was theoretically possible, but logging and protocol limitations mean it cannot determine whether information was actually viewed or copied, or to what extent. Škoda added that full payment card data was not directly accessible because transactions are handled by third-party payment providers, while urging customers to change reused passwords, remain alert for phishing messages, avoid suspicious links and attachments, and monitor bank and credit card statements for unusual activity.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Škoda notified the relevant data protection supervisory authority and publicly disclosed the security incident affecting its online shop. The company said payment card details were not directly accessible because payment processing is handled by third-party providers.
In response to the intrusion, Škoda took its online shop offline and fixed the exploited vulnerability. It also engaged a specialized IT forensics team to investigate the incident.
Škoda said attackers exploited a vulnerability in its online shop software and gained temporary unauthorized access to the system. The company stated that customer data stored in the shop could theoretically have been accessed, but logging limitations prevent determining whether data was actually viewed or copied.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcehelpnetsecurity.com
Open sourceskoda-auto.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ASUS disclosed unauthorized access to part of its **ASUS eShop** environment, potentially exposing customer contact details and order records. The company said payment-card, bank-account, and other financial information were not involved, and it has found no evidence of continuing unauthorized access or misuse of the accessed data. ASUS said it contained the incident, launched an investigation, and added security measures, but did not disclose the intrusion method, duration, affected regions, number of customers, or suspected actor. Customers were warned that purchase-related data could enable more convincing ASUS-branded phishing emails, SMS messages, phone calls, and online-message impersonation attempts.
Sep 29, 2026
Żabka, Poland’s largest convenience store chain, disclosed a cyberattack after attackers used a compromised account belonging to an external service provider to gain unauthorized access to internal technical systems. The company said it detected and blocked the intrusion late last week, notified Poland’s data protection authority and law enforcement, and reported that payment systems, transaction data, the **Żappka** loyalty app, and store operations were not affected. Poland’s Minister of Digital Affairs said authorities were informed promptly and that available information indicated customer data and retail operations were not impacted. The incident surfaced after hackers allegedly offered stolen Żabka data for sale on a cybercrime forum for **€5,000** and published sample files online. Reporting on the sample indicated the exposed material may include about **541,000 Jira issues**, roughly **229,734 service-desk tickets**, and source code from **89 GitLab repositories**, along with employee and contractor data, internal documentation, passwords, authentication tokens, and API keys. Review of the sample also pointed to a GitLab access token embedded across repository dumps and other live-looking secrets, including **Cloudflare API keys**, a **MongoDB** admin password, and messaging broker credentials, although Żabka has not confirmed the full scope of the allegedly stolen data.
Aug 5, 2026
Lidl disclosed a customer data breach affecting users of its online shop in **Germany, Belgium, and the Netherlands** after attackers compromised an external IT service provider and briefly accessed a separately stored file. The retailer said its online shop systems were **not** breached directly, but the exposed data includes customer names, telephone numbers, email addresses, dates of birth, salutations, and customer numbers. Lidl said it cannot yet rule out exposure of passwords, billing and delivery addresses, bank details, or other payment information, although it has not reported concrete evidence of misuse so far. The service provider has restored system security, filed a police report, and engaged forensic experts, while Lidl notified the relevant data protection authority, including the Dutch regulator, and warned affected customers to watch for phishing attempts and identity fraud.
Jul 18, 2026