Scania

Automotive giant Scania confirmed it suffered a cybersecurity incident where threat actors used compromised credentials to breach its Financial Services systems and steal insurance claim documents. The attackers then threatened to leak the data online unless their demands were met. The incident could have a significant impact on those affected, as insurance claim documents likely contain personal and possibly sensitive financial or medical data. The compromised application is no longer reachable online, and an investigation into the incident has been launched.

Source: https://www.bleepingcomputer.com/news/security/scania-confirms-insurance-claim-data-breach-in-extortion-attempt/

TPRM report: https://scoringcyber.rankiteo.com/company/scania

"id": "sca301061725",
"linkid": "scania",
"type": "Breach",
"date": "6/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'Automotive',
                        'location': 'Sweden',
                        'name': 'Scania',
                        'size': 'Over 59,000 employees',
                        'type': 'Company'}],
 'attack_vector': 'Compromised Credentials',
 'data_breach': {'data_exfiltration': True,
                 'sensitivity_of_data': ['Personal', 'Financial', 'Medical'],
                 'type_of_data_compromised': ['Insurance claim documents']},
 'date_detected': '2025-05-28',
 'description': 'Automotive giant Scania confirmed it suffered a cybersecurity '
                'incident where threat actors used compromised credentials to '
                'breach its Financial Services systems and steal insurance '
                'claim documents.',
 'impact': {'data_compromised': ['Insurance claim documents'],
            'systems_affected': ['insurance.scania.com']},
 'initial_access_broker': {'data_sold_on_dark_web': True,
                           'entry_point': 'Compromised Credentials'},
 'investigation_status': 'Ongoing',
 'motivation': ['Extortion'],
 'post_incident_analysis': {'root_causes': ['Compromised Credentials',
                                            'Infostealer Malware']},
 'ransomware': {'data_exfiltration': True, 'ransom_demanded': True},
 'references': [{'source': 'BleepingComputer'}],
 'regulatory_compliance': {'regulatory_notifications': ['Privacy authorities']},
 'threat_actor': ['hensi'],
 'title': 'Scania Cybersecurity Incident',
 'type': 'Data Breach',
 'vulnerability_exploited': 'Infostealer Malware'}