Cyber Incident Victim: Hyundai Motor Company Italy SRL

On or around April 11, 2023, Hyundai Motor Company Italy SRL disclosed a data breach impacting car owners and individuals who had booked test drives in Italy and France. The company issued a formal notice to affected customers, warning that unauthorized parties had gained access to a database containing personal information. The breach was reported by multiple sources on Twitter, and a sample of the customer notice was subsequently shared publicly. Hyundai is a major multinational automotive manufacturer, selling over half a million vehicles annually across the European market, and holds an approximate three percent market share in both France and Italy.

The investigation into the security incident determined that the attackers successfully accessed and exfiltrated specific types of personal data. The compromised information included the email addresses, physical addresses, and telephone numbers of affected individuals. Additionally, the vehicle chassis numbers, which are unique identifiers for each car, were also exposed in the breach. In its communication to customers, Hyundai provided a key clarification regarding the scope of the stolen data, explicitly stating that the hackers did not access or steal any form of financial data or national identification numbers during the intrusion.

In direct response to the discovery of the breach, Hyundai engaged external IT security experts to assist with its investigation and remediation efforts. A primary containment action involved taking the impacted IT systems completely offline. These systems were kept offline pending the implementation of additional security measures intended to prevent a similar incident from recurring. The company did not publicly disclose the exact duration of the network intrusion, the specific initial attack vector used by the threat actors, or the total number of customers impacted across the two countries.

The potential consequences of the data exposure were communicated to customers with a focus on the risk of follow-on attacks. Hyundai’s notice warned affected individuals to be highly cautious of unsolicited communications that claimed to originate from Hyundai or other entities within the Hyundai Group. The company highlighted the heightened risk of phishing attempts, social engineering attacks, and other fraudulent contact via email, physical mail, and text messages. Although Hyundai stated there was no evidence at the time of the disclosure that the stolen data had been actively used for fraudulent purposes, it advised extreme caution as a preventative measure.

The breach notification process followed relevant regulatory requirements. Both Hyundai Italia and Hyundai France formally informed the data protection authorities in their respective countries about the security incident. This step was part of their compliance obligations under data breach notification laws. The public disclosure of the incident through media reports and the sharing of the customer letter sample brought significant attention to the event, though the company itself did not immediately release further detailed public statements beyond the customer notices.

This incident occurred within a broader context of recent cybersecurity challenges for the Hyundai Motor Group. Just two months prior, in February 2023, the company had been compelled to issue emergency software updates for several of its car models. These updates addressed a critical security vulnerability that enabled thieves to steal vehicles using a simple USB cable exploit. Furthermore, in December 2022, security researchers had identified vulnerabilities within the official Hyundai app. These bugs could have allowed remote attackers to unlock and start the ignition of certain vehicle models or could have led to the exposure of car owner information, illustrating a pattern of security issues affecting different parts of the company's technological infrastructure.

The full impact of the April 2023 breach remained unclear at the time of public disclosure. Key details such as the exact number of affected customers in Italy and France were not released. It was also not confirmed whether customers in other European countries or other global markets were impacted by the same intrusion. The specific IT systems that were compromised, the total timeframe during which the attacker had access, and the identity or motivation of the threat actor behind the breach were not disclosed by the company in its initial customer communications or in subsequent early reports.