Scania confirms cyberattack and data breach of their corporate insurance division
Learn More
Swedish automotive giant Scania is reporting a cybersecurity incident targeting its Financial Services division which handles commercial vehicle insurance claims and related financial services.
The attack was caused by compromised credentials belonging to an external IT partner, which were stolen through infostealer malware. The breach was discovered after threat monitoring platform Hackmanac spotted a hacking forum post by a threat actor named 'hensi,' selling data they claimed to have stolen from 'insurance.scania.com,' offering it to a single exclusive buyer.
Exposed data includes:
- Insurance claim documents
- Personal information of claimants
- Financial details related to insurance claims
- Medical information (potentially, given the nature of accident claims)
- Vehicle identification numbers (VINs)
- Customer identities and contact information
The number of affected individuals is not disclosed.
The attacker sent emails from proton.me to a number of Scania employees threatening to publish the data. A follow-up email with similar content came later from an unrelated third party whose email had been compromised.
The compromised Scania application is no longer reachable online, and an investigation into the incident has been launched. Scania claims that the breach had limited impact and that it notified privacy authorities regarding the incident.
