Breach Disclosure: Audi

Breach Disclosure: Audi

In June 2021, German automobile manufacturer, Volkswagen and its subsidiary Audi, disclosed a data breach that resulted in the compromise of 3.3 million customer records. An unauthorized third party obtained the data after a vendor organization left Audi and Volkswagen data, as well as data from authorized dealers in the United States and Canada, unprotected on the internet. While most of the data included in the breach was personal information (such as a name, email address, and mailing address), more than 90,000 customers had sensitive information included in the breach, like social security numbers.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.
• Review network logs for potential signs of compromise and data egress.
• Enforce administrative or application control restrictions to prevent unauthorized installation of software or media.

Details

On June 15, 2021, ZeroFox observed an actor using the alias "000" offering to sell stolen customer information from Audi of America. The actor describes the stolen data as "Analytics Dump" with 5 million customer records from the year 2014 to 2019. The data dump also includes Vehicle Identification Numbers (VINs), email addresses, names, other customer information, two internal confidential files, and backups. Additionally, there are supposedly a pair of files in the data dump called Leads.csv (3,862,231 records) and Sale.csv (1,792,278 records). The actor did not disclose a fixed price for the database and shared a Telegram handle to communicate with potential buyers.

Figure 1: Actor "000" publishes a thread on Audi of America data breach package