Thought Leadership
The ransomware group Xpl0itrs has listed BMW as a victim and claims to have stolen around 800 documents related to motorcycles and authorized dealers.
To support its claims, Xpl0itrs published two archives of alleged BMW data in different sizes: a larger archive of around 280 MB containing approximately 636 PDF documents, and a much smaller archive of about 10 MB containing just four documents. It remains unclear whether the smaller collection is merely a preview or whether the larger archive already represents the full set of material allegedly stolen by the attackers.
According to an analysis by researchers at Cybernews, the documents in both archives primarily concern used BMW motorcycles. They include information on individual vehicles, their prices, and associated dealer details. The files also contain contact information for BMW and dealership employees, including names, email addresses, and phone numbers for individual dealerships.
Some Claims Appear to Be Exaggerated
The attackers also claim to have obtained configuration and API data, information about gas stations, details on subsidiaries, and other sensitive data points. However, Cybernews researchers found no evidence of this information in the datasets actually published. They therefore consider this part of the attackers’ claims to be significantly exaggerated.
The researchers also identified several documents that were publicly accessible online and appeared to be identical to files published by Xpl0itrs. This suggests that at least some of the leaked material may not have been obtained exclusively through a breach of BMW systems, but may have already been available elsewhere on the internet.
Aggregated Data Could Enable Targeted Fraud
Even when individual documents are publicly accessible, the Cybernews researchers consider the consolidated dataset a risk in its own right. By bringing information together in a single collection, the data makes it significantly easier for attackers to research individual employees. Information on multiple people is available in one place rather than having to be collected from separate sources.
Criminals could, for example, use the information to craft fraudulent messages using the name, dealership, and contact details of a real employee. Such messages could be designed to appear as if they originated from BMW’s internal sales network.
Cybernews has contacted BMW for comment. No response had been received at the time of publication.
(Editorial Team)
