Spate of Ransomware Attacks Targets Automotive Industry in Early 2025

By Shin Li (Staff Threat Researcher, Automotive)

The year has only just begun, yet a wave of ransomware attacks has swept across industries, with the automotive industry among the hardest hit. In this article, in addition to outlining the reported automotive ransomware incidents, we examine several recent cases and their wider impact on automotive cybersecurity.

Automotive ransonmware incidents

Our internal research shows that from January to mid-February 2025, reported automotive ransomware incidents have already exceeded those in the same period of 2024. The table below highlights this concerning trend.

Table 1. A breakdown of the ransomware attacks that targeted the automotive industry from Jan. 1 to Feb. 17, 2025.

Notably, ransomware groups such as SafePay, Qilin, and Lynx have targeted multiple automotive-related organizations, from parts manufacturers to car dealerships. This pattern underscores a growing concern: Cybercriminals are increasingly viewing the automotive industry as a lucrative and vulnerable target.

Automotive cybersecurity insights

With ransomware attacks likely to persist in 2025, we review recent cases from Japan, Italy, and Australia to provide valuable insights into the evolving threat landscape. These incidents are not isolated but part of a broader pattern of disruption affecting organizations worldwide. We examine these examples not to highlight the challenges faced but to uncover the tactics used and understand their broader implications for automotive cybersecurity.

A precision parts manufacturer based in Japan

The Qilin ransomware group reportedly exfiltrated over 500 GB of sensitive data, including engineering blueprints and supplier agreements, from a precision parts manufacturer in Japan. This manufacturer produces critical components such as gears, shafts, and custom-machined parts for some major Tier 1 global automakers (OEMs).

Although the manufacturer swiftly isolated infected servers and restored operations from backups, the exposure of technical documentation raised serious industry concerns. While it confirmed an ongoing investigation, it did not disclose details regarding ransom demands or negotiations — underscoring the persistent risks that suppliers face in handling vital designs across multiple OEMs.

A high-precision measurement solutions provider based in Italy

Unidentified attackers encrypted critical internal servers at an Italy-based company specializing in high-precision measurement solutions, briefly disrupting logistics and administrative functions. This company provides sensors, gauges, and advanced diagnostic tools for engine assembly lines, powertrain R&D, and automated quality control.

While the impact on production was reported to be minimal, the extent of potential data exfiltration remains unclear. The company promptly notified Italian authorities, implemented short-term departmental shutdowns, and committed to strengthening its cybersecurity posture.

A leading truck and trailer dealership based in Australia

A leading truck and trailer dealership in Australia fell victim to a ransomware attack. The newly emerging Lynx group claimed responsibility for the attack, which purportedly resulted in the theft of 170 GB of sensitive data, including HR records and financial documents.

Involving a key supplier to commercial fleets, the breach raises serious concerns for transportation firms relying on timely vehicle servicing. The company swiftly took affected systems offline and engaged cybersecurity specialists, but it did not confirm whether ransom demands were met or whether customer data remained secure. To pressure compliance, Lynx posted partial data on the dark web, highlighting how even specialized dealerships in remote regions remain prime targets for escalating waves of cyberthreats.

Conclusion

In 2024, cyberattacks primarily targeted suppliers, third-party providers, and dealerships, with some incidents far surpassing those aimed at OEMs. The surge in ransomware attacks at the start of 2025 suggests a continuation of this trend, highlighting a couple of sobering realities.

First, when key supply chain players such as precision parts manufacturers and specialized service providers are hit by cyber intrusions, the fallout ripples far beyond the initial target. For instance, a breach in quality control systems can derail entire production lines, while compromised fleet operations can delay deliveries, affecting partners and customers across the industry.

Second, digital interconnectedness in today’s global economy has erased geographic boundaries for cyberthreats, exposing businesses across diverse regions to sophisticated attacks. No corner of the automotive ecosystem is immune.

The rising risk of automotive cyberthreats calls for urgent action involving proactive cybersecurity measures, robust incident response plans, and stronger industrywide collaboration. Through information sharing and coordinated defenses across the automotive ecosystem, OEMs, suppliers, and service providers can strengthen the industry’s resilience against the growing risks posed by today’s advanced threat actors.