xpl0itts Claims Expanded BMW IDOR Breach Includes Data From 36 Other Automakers
Summary
xpl0itts claims an ongoing BMW-related breach has expanded through collaborations with DarkRomance and teamPCP, involving employee and customer data, VINs and technical information, plus data allegedly tied to 36 other automakers.
Key points
- xpl0itts claims the BMW IDOR and document breach has expanded with DarkRomance, teamPCP and another group, with exfiltration reportedly ongoing.
- The actors reportedly claim tens of thousands of employee and customer records, including names, addresses, vehicle information and VINs.
- The alleged technical data includes Kubernetes infrastructure, configuration files, API data and dealer subdomain mapping.
- The claim includes data from Mazda, Toyota, Audi, Ford and 32 additional automakers, as well as multi-brand personal information and internal chats.
- The IDOR exploit is reportedly offered for sale; file-upload and IDOR vulnerabilities across portals are cited as initial access vectors.
Article Details
- Victim Organization
- BMW
- Incident Type
- Claimed data breach involving IDOR and file-upload vulnerabilities, with reported ongoing data exfiltration.
- Data Types Exposed
- Employee and customer personal information, including full names and addresses
- Vehicle information and VINs
- Kubernetes infrastructure data
- Internal configuration files
- API data
- Dealer subdomain mapping
- Internal chats
- Affected Records
- Tens of thousands of employee and customer PII records were reportedly stolen; exact count not provided.
- Operational Impact
- Threat actors claim access to BMW data and data associated with Mazda, Toyota, Audi, Ford, and 32 additional automakers. They report that exfiltration is ongoing; the article does not independently confirm the claims.
- Claim Status
- claimed
Threat Actors
DarkRomanceNamed as a collaborator in xpl0itts's claims about the expanded breach and ongoing exfiltration; the claimed involvement is not independently confirmed.TeamPCPNamed as a collaborator in xpl0itts's claims about the expanded breach and ongoing exfiltration; the claimed involvement is not independently confirmed.xpl0ittsClaims responsibility for the expanded BMW IDOR and document breach, ongoing exfiltration, and access to data associated with multiple automakers; these claims are not independently confirmed in the article.