Login
iscover
Share this article on:
Powered by
MOMENTUM
MEDIA
Powered by MOMENTUMMEDIA
The financial services division of German automaker BMW has suffered as a result of a third-party data breach.
BMW Financial Services has become caught up in the breach of Texas fintech firm AIS Infosource LP (AIS), which provides customers with data analytics, technology and more for financial services firms.
According to a report by Oklahoma law firm Federman & Sherwood, the breach was first discovered on 17 February, which determined access had occurred between 16 February and 21 February.
While details on the breach are sparse, a breach notification from AIS to clients seen by media says that the fintech firm launched an investigation after it detected suspicious activity on its network, which uncovered that unauthorised actors had breached its network and exfiltrated data.
AIS has revealed that potentially compromised data includes names, Social Security numbers and financial account numbers. The company also confirmed that 1,950 people were affected by the incident.
While it is unclear whether or not any BMW data was exfiltrated, AIS confirmed that the breach did not affect the systems or databases of BMW Financial Services.
Just last month, threat actors claimed a cyber attack on another German automaker, Volkswagen, claiming to have exfiltrated the personal and security data of customers and their vehicles.
Volkswagen Group is the second-largest car manufacturer in the world in sales, the largest in the world in revenue and the largest company in Europe. It owns brands such as Porsche, Audi, Bently, Lamborghini, Cupra, SEAT, Škoda, and Volkswagen.
On 1 June 2025, the Stormous ransomware gang listed Volkswagen Group on its dark web leak site, claiming to have exfiltrated an unspecified amount of data.
According to the listing, the threat actors stole “user account data (partially hidden emails), authentication tokens (OAuth tokens, JWT tokens), login links for external systems”, session cookies, identity and access information, including phone numbers, emails, profile details, vehicle VIN numbers, and “authentication and access control details”.
Stormous now claims to have published Volkswagen Group’s data. It is unclear if the claim is legitimate.
Be the first to hear the latest developments in the cyber industry.
