Cyber Incident Victim: Discount Car and Truck Rentals
Date:
Feb 2021
Location:
Canada
Summary
A leading Canadian car rental firm, part of Enterprise Holdings, experienced a ransomware attack by the DarkSide group, disrupting online services and prompting temporary website unavailability. The attackers claimed exfiltration of 120GB of unencrypted corporate data, including financial, marketing, banking, account, and franchisee information, sharing folder listings as purported evidence. The company's dedicated response team isolated and contained the incident while working to restore operations. DarkSide, known for prior charitable donations and decryptor vulnerabilities, listed the victim on their leak site alongside other high-profile targets.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
Canadian Discount Car and Truck Rentals, a major Canadian rental company operating 300 locations and acquired by Enterprise Holdings’ Canadian subsidiary in 2020, experienced a cyberattack attributed to the DarkSide ransomware gang on or around February 13, 2021. The attack disrupted the company’s online rental services, rendering its discountcar.com website inaccessible for bookings or reservations. Visitors attempting to access the site were met with a notification citing technical difficulties and instructing them to contact the company via phone. Discount Car and Truck Rentals confirmed the ransomware incident impacted its headquarters office, activating a dedicated internal team that swiftly isolated and contained the breach. The organization prioritized investigating the attack and restoring services safely but did not disclose technical details regarding the intrusion vector or specific affected internal systems.
DarkSide publicly claimed responsibility for the attack on its data leak site, alleging the theft of 120 gigabytes of unencrypted corporate data prior to deploying ransomware. The gang specified the exfiltrated data included financial records, marketing materials, banking information, account details, and franchisee-related documents. As evidence, DarkSide published screenshots depicting folder structures purportedly belonging to Discount Car and Truck Rentals, though the authenticity and comprehensiveness of the stolen data remained unverified. The incident occurred amid broader scrutiny of DarkSide’s operations, including the release of a universal decryptor by Bitdefender in late 2020 that weakened the gang’s leverage over some victims. Other organizations targeted by DarkSide around this period included Brookfield Residential and energy firms Eletrobras and Copel. Discount Car and Truck Rentals did not publicly confirm data theft or specify whether ransom demands were issued or negotiated. The company’s restoration efforts focused on resuming online operations while containing further disruption to its rental services across Canada.