Personal details of hundreds of thousands of car owners in the UK, including owners of BMW, Mercedes, Honda, Hyundai, and SEAT cars, have been accessed by a hacker group and put up for sale on a Dark Web forum.
The massive breach of personal records of UK car owners was discovered by Israeli threat intelligence firm KELA which noted that out of half-a-million car owners whose data was accessed by hackers, 384,319 were BMW owners and the rest owned Honda, Hyundai, Mercedes, and SEAT cars.
The theft was carried out by a hacker group called KelvinSecurity Team which stole a database containing all these records from an unnamed call centre that deals with a number of car manufacturers in the UK. The theft was carried out with the aim of selling records of car owners on the Dark Web for profit.
As proof of its exploit, the hacker group has released certain information on a Dark Web forum such as initials and last names of BMWowners, their email addresses, home addresses, vehicle numbers, and other information. According to KELA, most of the information in the database is dated between 2016 and 2018.
The security firm told news agencies that KelvinSecurity Team is very much active on Dark Web forums, offering as many as sixteen databases for sale in June that belonged to U.S. government contractors and some that contained data about Russian military weapons development.
Hackers will use the data of BMW owners to launch massive phishing campaigns
The fact that the group has also dumped databases belonging to organisations in Australia, Mexico, Iran, France, and Sweden for free on the Dark Web indicates that it is willing to target organisations worldwide instead of focussing on specific countries or regions.
Commenting on the massive breach of personal records of BMW car owners, Jake Moore, a security researcher at ESET, told Tom's Guide that hackers will exploit the success by launching massive phishing campaigns by pretending to be BMW or a partner organisation.
“I would recommend any vehicle owner to be extremely cautious when opening emails suggesting they are from the likes of BMW and Mercedes from now on. Phishing emails that request any further data can be used in conjunction with stolen data from the breach and could be used in a future attack or identity theft.
"It is now vital that all affected customers are extra vigilant whenever they receive unsolicited emails that appear to be from their manufacturer that request further information, personal, financial, or otherwise as these could include links to well-crafted cloned websites," he added.