BMW customer database for sale on dark web

A database of 384,319 BMW car owners in the U.K. is being offered for sale on an underground forum by the KelvinSecurity Team hacking group, according to KELA, a darknet threat intelligence firm, based in Tel Aviv.

The hacking group, which last week tried to sell databases related to U.S. business consulting firm Frost & Sullivan, made the BMW data available, including initials and last names, emails, addresses, vehicle numbers, dealer names, among other information.

KELA told SC Media KelvinSecurityTeam has been highly active on underground forums, offering in June 2020 alone for sale 16 databases, including data related to U.S government contractors and Russian military weapons development. In addition, the group reportedly dumped for free 28 databases affecting entities in Mexico, Iran, U.S., Australia, Sweden, France and Indonesia. 

KELA said it also found a database of owners offered for sale on an underground forum.

According to KELA, the threat actor claimed that the BMW data came from a “call center” that manages customers of different car suppliers. KELA said it obtained the database and found that it contains almost 500,000 customer records from 2016 to 2018, also affecting U.K. owners of other car manufacturers, including Mercedes, SEAT, Honda and Hyundai, among others.