Data breach at Nordic e-scooter company Ryde exposes 4.5 million customer accounts

Electric scooter company Ryde has disclosed a data breach affecting all of its account holders, an estimated 4.5 million customers across Norway, Sweden, Finland and Germany, after an unauthorized party accessed its systems and copied customer information.

The intrusion occurred on Sunday, Aug. 2. Ryde said the attacker’s access to its systems was subsequently blocked, but not before information was taken from every customer account on the platform. The company said it has no indication of who carried out the attack.

The data copied included phone numbers, email addresses, dates of birth, partial payment card numbers and customers’ payment history, according to the company. Ryde said no other location data, including ride history, was extracted beyond the location where a customer’s account was created, and said there is no indication that travel data was affected.

The company said full card numbers are not stored by Ryde itself but by its payment provider, and told customers they do not need to take action on their accounts or block their cards.

Ryde cautioned that the stolen information could be used in phishing attempts, with attackers potentially posing as the company or referencing real transactions to appear credible. The company urged customers never to share passwords, one-time banking codes or BankID credentials with anyone who contacts them, regardless of how much information that person appears to have, stating that neither Ryde nor customers’ banks would ever request such details.

The breach ranks among the largest to affect a micromobility company, given that it touched nearly the entirety of Ryde’s registered user base across the four markets where it operates.