Hyundai Europe confirms it was hit by a major ransomware attack

9 February 2024, 14:05 published

Hyundai Motor Europe, the South Korean carmaker’s European division, has confirmed suffering a ransomware attack earlier this year.

In early January, news broke of a cyber-incident within the firm, but Hyundai quickly shot the talk down, claiming to just having experienced “IT issues”.

However, BleepingComputer uncovered new evidence pointing to a data theft incident, after which Hyundai came clean and confessed.

Major threat

“Hyundai Motor Europe is investigating a case in which an unauthorized third party has accessed a limited part of the network of Hyundai Motor Europe,” Hyundai Motor Europe said in a stratement.

“Our investigations are ongoing, and we are working closely with external cybersecurity and legal experts. Relevant local authorities have also been notified. Trust and security are fundamental to our business, and our priority is the protection of our customers, employees, investors, and partners.”

More details are yet to emerge from the firm, including who ran the attack, what type of information was stolen (customer data, employee data, partner data, or something else entirely), if there were any ransom demands, and what they were. So far, we have reports from BleepingComputer stating that it was the Black Basta ransomware threat actor that orchestrated the attack, and that approximately 3 terabytes of data were taken.

The publication claims to have seen lists of folders possibly stolen from different Windows domains, including those from KIA Europe. Folder names suggest the data belonged to legal, sales, human resources, accounting, IT, and management departments.

Black Basta was first seen in April 2022, and has since then grown to become one of the biggest and most dangerous ransomware operators out there.

Late last year, a Sophos report stated that a number of ransomware operators, including Black Basta, started intentionally using remote encryption, a super destructive method of ransomware attack. The company’s anti-ransomware CryptoGuard technology detected a 62% increase, year-on-year, in intentional remote encryption attacks.