BMW acknowledges cyber incident, safety audit documents released by hacker
Luxury car manufacturer BMW has confirmed a cyber incident involving one of its American third-party service providers. The Everest ransomware group claimed responsibility for the breach, stating they accessed “critical BMW audit documents” in a post dated 14 September. BMW has acknowledged that the incident pertains to its supply chain and involves a data breach at a third-party service provider in the United States. A spokesperson for BMW indicated that the breach relates to internal quality management documents.
As a precautionary measure, BMW has blocked access to affected accounts and conducted extensive security checks. At this time, there is no evidence suggesting a compromise within BMW’s own infrastructure. The company emphasised its commitment to data protection and security, stating that it is collaborating closely with partners and authorities to investigate the incident thoroughly. Following the initial claims, Everest has released documents indicating that the third party involved is Change2Target, a supplier management firm that assists BMW with auditing its production processes. These documents reportedly include safety audit records that name BMW staff and highlight alleged issues with industrial practices.
