Medusa ransomware gang claims the hack of Toyota Financial Services

Toyota Financial Services discloses unauthorized activity on systems after the Medusa ransomware gang claimed to have hacked the company.

Toyota Financial Services confirmed the discovery of unauthorized activity on systems in a limited number of its locations.

“Toyota Financial Services Europe & Africa recently identified unauthorised activity on systems in a limited number of its locations. We took certain systems offline to investigate this activity and to reduce risk, and have also begun working with law enforcement.” reads a statement published by the company. “In most countries, we have started bringing our systems back online. We are working diligently to get systems back online as soon as possible and we regret any inconvenience caused to our customers and business partners. As of now, this incident is limited to Toyota Financial Services Europe & Africa.”

In response to the security incident, the company took the impacted systems offline and launched an investigation with the help of law enforcement.

The security incident appears to have been limited to TFS Europe & Africa. The company has yet to disclose a data breach.

Toyota Financial Services (TFS) is the finance arm of the Toyota Motor Corporation. It is a subsidiary of Toyota and provides a range of financial services to Toyota customers and dealerships worldwide. TFS offers various financial products, including auto loans, leases, and insurance solutions. The goal of TFS is to support Toyota customers in financing their vehicles and to facilitate the purchase or lease of Toyota vehicles through flexible and tailored financial options. The services provided by Toyota Financial Services may vary by region, and customers can typically access these services through Toyota dealerships or online platforms.

Today, the Medusa ransomware gang claimed responsibility for the attack and threatened to leak the purportedly stolen data if the company doesn’t pay the ransom.

The Medusa ransomware group is demanding a payment of $8,000,000 to delete data allegedly stolen from the company, and they are offering the option to extend the deadline for an additional $10,000 per day.

Medusa Toyota has set the deadline for November 26 and has published a sample of the stolen data as proof of the hack.

Leaked sample data includes financial documents, invoices, hashed account passwords, passport scans, and more. The documents are in German, a circumstance that suggests that they have been stolen from company systems located in Germany.

The popular cyber security expert Kevin Beaumont first noticed that the company office in Germany had a vulnerable Citrix Gateway exposed online. Threat actors likely exploited the vulnerability Citrix Bleed to gain initial access to the company’s network.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ransomware)