Thoro Bicycles

Summary

A cybercriminal listed data belonging to Italian bicycle company Thoro Bicycles for sale on Breach Forums, a hacking community established as an alternative to the seized Raid Forums. The compromised dataset contained approximately 31,000 records, including corporate and personal details such as names, email addresses, physical addresses, sales information, account activation statuses, newsletter preferences, and timestamps for registration and last website activity. The threat actor provided samples of the stolen data within their forum post and invited potential buyers to contact them directly to negotiate purchase terms. The incident represented a significant exposure of customer and operational information through illicit channels.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On or around September 8, 2022, a threat actor advertised the sale of stolen data belonging to the Italian company Thoro Bicycles on Breach Forums, a cybercrime platform established in March 2022 as a replacement for the seized Raid Forums. The forum post included a sample of the compromised database, which contained approximately 31,000 records with fields exposing sensitive business and personal information. Each record comprised organizational identifiers ("Id"), company details ("Titolo sociale"), individual identifiers ("Nome" and "Cognome"), contact information ("Indirizzo email"), commercial activity metrics ("Vendite"), account status markers ("Attivato"), marketing preferences ("Newsletter" and "Opt-in"), and temporal markers for user activity ("Registrazione" and "Ultima visita"). The advertisement provided instructions for potential buyers to contact the seller to negotiate purchase terms, though no explicit ransom demand or extortion tactic was detailed in the disclosed post. The breach exposed operational and customer relationship data that could facilitate targeted phishing campaigns, financial fraud, or competitive intelligence gathering against the bicycle manufacturer.

The incident represented an early high-profile compromise advertised on Breach Forums, which had been operational for approximately six months following its creation by threat actor "pompompurin" after law enforcement dismantled Raid Forums. The forum operator had publicly stated intentions to redirect traffic to Raid Forums if it officially resumed operations, indicating potential instability in the criminal marketplace. Cybersecurity monitoring service RedHotCyber documented the advertisement but noted no immediate public response or official statement from Thoro Bicycles regarding the breach's validity or impact. Exposure of registration dates and last-visit timestamps created additional risks for credential-stuffing attacks against users who might have reused passwords across multiple platforms. The data structure suggested compromise of systems managing customer accounts, sales tracking, and marketing communications, though the specific intrusion vector, duration of unauthorized access, and containment measures remained undisclosed in available reporting.

Sources

Sources available to members: 1 source.