766,000 Impacted by Data Breach at Dealership Software Provider Motility

"Dealership software company Motility Software Solutions is notifying over 766,000 people that their personal information was compromised in a ransomware attack. A provider of software for recreational vehicle and power sport dealers, Motility discovered the incident on August 19, after hackers accessed servers that support the company's business operations. The attackers, the company says, deployed file-encrypting ransomware on its systems, but also stole files containing customers' personal information."

"The affected data, it says, includes names, addresses, phone numbers, email addresses, dates of birth, Social Security numbers, and driver's license numbers. "At this time, we have no evidence of actual misuse of the information; nevertheless, we are issuing this notice so that you can take appropriate steps to safeguard your information," Motility writes in the notification letter sent to the affected individuals."

"Last week, however, the Pear ransomware gang listed Reynolds and Reynolds on its Tor-based leak site, claiming the theft of 4.3 terabytes of data. Given that Reynolds and Reynolds previously said that its systems and network were not affected by the Motility incident, it is likely that the data Pear allegedly stole came from the subsidiary. The cybercrime group has made the data available for download, which suggests that no ransom was paid."

Motility Software Solutions discovered a ransomware incident on August 19 after hackers accessed servers supporting company operations. Attackers deployed file-encrypting ransomware and exfiltrated files containing names, addresses, phone numbers, email addresses, dates of birth, Social Security numbers, and driver's license numbers for 766,670 individuals. Motility reported no evidence of actual misuse while notifying affected individuals and the Maine Attorney General's Office. The company restored systems from clean backups, implemented additional security measures, and provided 12 months of identity theft and credit monitoring services. The Pear ransomware gang later listed Reynolds and Reynolds on a leak site claiming 4.3 terabytes of stolen data.

Read at SecurityWeek