A major data breach involving software used by car dealerships could expose car buyers across Germany to widespread fraud. The attack primarily affected dealerships selling Volkswagen Group vehicles.
The attackers stole transaction data, including order and invoice numbers, delivery dates, payment amounts and financing details. Using this information, they are sending fraudulent payment requests and notices of changes to bank details that are extremely difficult to distinguish from legitimate communications, DPA reports.
German police have confirmed a cyberattack on an IT service provider near Würzburg. The attackers reportedly gained access through third-party software containing a serious security vulnerability. Volkswagen acknowledged that the compromised software was used by its subsidiary network, Volkswagen Group Retail Deutschland, which operates around 120 dealerships, and said affected customers had been notified.
Customers have been urged to exercise particular caution, especially when receiving invoices shortly before collecting a vehicle. They are advised to verify payment details by contacting dealerships through official phone numbers, avoid clicking links in emails and pay attention to bank warnings about discrepancies between the beneficiary’s name and account details.
The exact number of people affected by the breach remains unknown.
