Volkswagen Group targeted by Stormous ransomware group

• Ransomware group: Stormous
• Country: Germany
• Sector: Manufacturing
• Announcement date: May 31, 2025

The Stormous ransomware group has published an announcement on its leak site claiming to have targeted the Volkswagen Group. According to the group's claims, the breach involves the exposure of sensitive user account data and various authentication credentials belonging to the multinational automotive giant.

The claimed attack and event details

On May 31, 2025, the Stormous group posted an announcement alleging they had successfully targeted the Volkswagen Group. The group claims to have obtained technical data that could potentially provide unauthorized access to the organization's internal systems. This type of activity is characteristic of modern ransomware operations, where groups often employ double extortion tactics. In such scenarios, attackers not only encrypt an organization's data to disrupt operations but also threaten to leak sensitive information on public leak sites to pressure the victim into paying a ransom.

The announcement made by the group suggests that the breach is not merely a matter of stolen files, but involves technical assets that could compromise the integrity of the company's digital environment. The group has shared various authentication tokens and session details as part of their public announcement, signaling a significant potential impact on the organization's access control security.

Data allegedly involved in the leak

The information allegedly leaked by the Stormous group includes a variety of technical and personal identifiers. The group claims to have accessed data that could facilitate unauthorized entry into internal systems. The specific types of data mentioned in the leak include:

• Partially hidden email addresses
• OAuth and JWT tokens
• Internal system login links
• Session cookies (such as JSESSIONID)
• Identity and access information, including profiles and phone numbers
• Vehicle identification numbers (VIN)

The presence of session cookies and authentication tokens is particularly concerning for cybersecurity professionals, as these elements are often used to maintain active user sessions, potentially allowing an attacker to bypass traditional login requirements.

About Volkswagen Group

Volkswagen Group is a multinational automotive company headquartered in Germany. It is one of the world's largest automakers, owning several well-known brands including Volkswagen, Audi, Porsche, Skoda, and SEAT. The company designs, manufactures, and distributes passenger and commercial vehicles on a global scale.

Risk assessment and defensive considerations

This alleged leak poses a significant risk to the account security of users within the Volkswagen Group. The sharing of session cookies and authentication tokens could potentially lead to unauthorized access to internal systems. Given that the organization is located in Germany, this situation may trigger data breach notification obligations under the General Data Protection Regulation (GDPR).

Furthermore, considering the politically motivated activities often associated with the Stormous group, it is assessed that this incident could create a foundation for secondary attacks or targeted phishing campaigns. When attackers possess specific details like phone numbers and vehicle identification numbers, they can craft highly convincing social engineering attacks against both employees and customers.

In response to such incidents, organizations typically need to review their access control mechanisms and invalidate the affected tokens to prevent further unauthorized access. Strengthening multi-factor authentication (MFA) and implementing strict session management policies are common defensive steps to mitigate the impact of stolen authentication credentials. Organizations in the manufacturing and automotive sectors must remain vigilant against these evolving threats to protect both their internal infrastructure and their customer data.