Scania hit by cyberattack - thousands of customers potentially affected, here's what we know

Date:
Wed, 18 Jun 2025 15:07:00 +0000

Description:
After unsuccessfully extorting Scania for money, hackers are now trying to sell stolen files on the dark web.

FULL STORY ======================================================================An external IT partner to Scania lost its login credentials through an infostealer The hackers used the password to access Scania and steal files They asked the company for money, and later offered the archive for sale

Swedish automotive manufacturer Scania has confirmed suffering a cyberattack which saw it lose sensitive customer data.

Security researchers Hackmanac found a new thread on a dark web forum, in which a database allegedly stolen from insurance.scania.com was being offered for sale to an exclusive buyer for an unknown sum of money.

hi guys. we hacked new target and selling full attachment of 'insurance.scania.com'. Full attached files is 34,000 and first time hacked + just will 1 hand sell, the ad, published in both English and Russian, reads. few pic attached with remarks (for no one cant copy and scam people).

Save up to 52% off Lifelock Identity Theft Protection!

Your personal info is in endless places. And any one of them could accidentally expose you to identity theft. That's why LifeLock monitors hundreds of millions of data points a second for identity theft. LifeLock.
For the threats you can't control.

Preferred partner ( What does this mean? ) View Deal Supply chain attack

After the thread was posted, Scania confirmed the authenticity of the claims, saying it was breached in late May 2025 as part of a supply chain attack
which originated at an external IT partner.

"We can confirm there has been a security related incident in the application "insurance.scania.com", the application is provided by an external IT partner," a Scania spokesperson said.

"On the 28th and 29th of May, a perpetrator used credentials for a legitimate external user to gain access to a system used for insurance purposes; our current assumption is that the credentials used by the perpetrator were
leaked by a password stealer malware ."

"Using the compromised account, documents related to insurance claims were downloaded."

Although the company did not detail what information was found in the stolen files, its safe to assume that it is sensitive, possibly financial, or medical. The number of affected individuals is also unknown for now.

After stealing the archives, the threat actor tried to extort Scania for money, reaching out on multiple occasions and demanding a ransom. Since it ended up offering the database for sale on the dark web, we can assume that the company declined the generous offer.

Via BleepingComputer You might also like Infostealers on the rise: the
latest concern for organizational defenses Take a look at our guide to the best authenticator app We've rounded up the best password managers



======================================================================
Link to news story: https://www.techradar.com/pro/security/scania-hit-by-cyberattack-thousands-of- customers-potentially-affected-heres-what-we-know


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)