Ransomware targets the automotive sector. Everest group claims it obtained Chrysler data

Ransomware group Everest claims it obtained more than 1 TB of internal data related to automaker Chrysler. The information appeared on the group's so‑called leak site, where attackers publish data or threaten to release it as part of extortion campaigns.

According to available information, the attackers specifically refer to 1088 GB of data, which they describe as a database related to 'Chrysler operations'. At the time the claim was posted, the scope of the incident had not been officially confirmed by the company or its parent group Stellantis. It is therefore necessary to carefully distinguish between the attackers' claims and verified facts.

What we know so far

Publicly available information indicates this is a classic "leak-and-extort" scenario, i.e. a combination of:

• data theft (exfiltration)
• and pressure on the victim through the threat of their publication

This is not a new trend of recent months, but a longstanding model used by ransomware groups. It is applied particularly when attackers want to increase pressure on organizations that have effective backups and system recovery.

Who is the Everest group

The Everest group is among the established ransomware actors that have appeared in recent years in connection with attacks on organizations across various sectors. A typical feature of their campaigns is an emphasis on working with stolen data, not just encrypting systems.

The aim is to create pressure not only technically, but above all reputational, legal and commercial.

Why automotive is a frequent target

The automotive industry has long been attractive to ransomware groups, among other reasons because of:

• extensive supply chains and external dependencies
• the combination of modern IT systems and legacy OT environments
• high demands for production continuity
• and significant reputational risks

Attacks on the automotive sector are therefore not an exception, but part of a long-term trend affecting industrial manufacturing as a whole.

Data leaks as the primary tool of coercion

The Chrysler case – regardless of its final scope – again reminds us why data theft is such an effective tool for attackers. Even in situations where the organization manages to restore operations, the threat of publishing internal documents can represent a substantial reputational and legal risk.

Investigating such incidents today therefore concerns not only IT teams, but also crisis management, legal departments and communications.