Mercedes-Benz

Summary

A cyberattack targeting an IT solutions provider used by Mercedes-Benz Financial Services Italia potentially compromised customer and guarantor data, including names, surnames, and tax codes, though no financial, judicial, or sensitive information was confirmed exposed. The company notified affected individuals under EU regulations, engaged with the impacted supplier and data protection authorities, and initiated reviews of the supplier’s security measures to prevent future incidents. Customers were advised to exercise heightened caution against unsolicited communications and to avoid interacting with suspicious messages or attachments.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In early 2024, Mercedes-Benz Financial Services Italia notified customers of a cybersecurity incident stemming from an attack on one of its qualified IT suppliers, which specialized in providing computer solutions for financial and banking intermediaries. The breach exposed the possibility that client and guarantor data—specifically names, surnames, and tax codes—had been compromised. The company clarified that no sensitive categories of information, such as financial details, judicial records, or special personal data, were affected. Mercedes-Benz Financial Services Italia issued the notification in compliance with Article 34 of the European General Data Protection Regulation (GDPR), confirming its engagement with the Italian Data Protection Authority (Garante) regarding the incident. The attack’s origin and the exact timeline of its detection were not disclosed, but the supplier’s role in handling intermediary-related systems implied indirect exposure of Mercedes-Benz’s customer information.

Following the attack, Mercedes-Benz Financial Services Italia maintained close coordination with the affected supplier and regulatory authorities to address the breach. The company publicly apologized for the incident and emphasized that data security remained a priority, though it did not specify whether its own systems were directly compromised. It announced ongoing evaluations to implement additional security measures at the supplier level to prevent recurrence. Customers were advised to exercise heightened caution against unsolicited communications, particularly emails or messages from unknown sources, and instructed to delete suspicious content immediately without responding or opening attachments or links. For further assistance, the company directed inquiries to a dedicated phone number but did not disclose whether credit monitoring or identity theft protection services were offered. The incident underscored third-party risks in financial data handling but avoided direct attribution to threat actors or detailed technical impacts.

Sources

Sources available to members: 1 source.