Volkswagen Faces Data Extortion Threat from 8Base Ransomware Group Volkswagen Group is responding to claims by the ransomware group 8Base, which alleges it stole and leaked sensitive data from the automaker. While Volkswagen maintains that its core IT infrastructure remains unaffected, the company’s statement leaves uncertainty about the full extent of the breach, suggesting a possible third-party compromise. The 8Base ransomware operation, active since early 2023, surfaced in September 2024 with claims of a major breach at Volkswagen. Known for its Phobos ransomware variant and double-extortion tactics, the group asserted it exfiltrated confidential files on September 23, 2024, threatening public release by September 26. Though no leaked samples appeared by the deadline, 8Base listed the stolen data on its dark web site, including: - Invoices and receipts - Accounting documents - Employee personal files and contracts - Confidentiality agreements - Certificates and personnel records The breach could involve financial and personal data across Volkswagen’s global operations, affecting brands such as Audi, Porsche, Bentley, Lamborghini, Škoda, SEAT, and Cupra. Security experts note that 8Base operates primarily as a data extortion group, prioritizing theft over encryption to pressure victims into payment. Since its emergence, the group has targeted over 400 organizations, often gaining access via phishing or purchased credentials. Volkswagen, headquartered in Wolfsburg, Germany, confirmed awareness of the incident but emphasized that primary IT systems were not impacted, hinting at a potential supply chain or partner breach. With 153 production plants worldwide and hundreds of thousands of employees, the exposure of sensitive data raises GDPR compliance concerns, with potential fines of up to 4% of global revenue if confirmed. The incident highlights the growing risk of third-party vulnerabilities in critical industries like automotive manufacturing. Investigations remain ongoing.