Volvo Employee SSNs Stolen in Supplier Ransomware Attack

Volvo Group North America was caught in a supply-chain ransomware incident centred on Miljödata, a Swedish occupational SaaS provider, with Miljödata’s cloud infrastructure breached in August. As a Miljödata customer, Volvo NA’s systems remained untouched, but employees’ names and Social Security numbers were stolen and potentially published to the Dark Web, according to Volvo NA, which employs just shy of 20,000 people.

Miljödata is widely spread across Sweden, supplying around 80% of the country’s municipal governments, and the breach affected a broad set of organisations beyond Volvo, including universities and other companies. On Aug. 20, the DataCarry ransomware group breached Miljödata’s cloud; on Sept. 12 they warned they would publish the stolen data, and that threat was subsequently carried out.

The attackers demanded a ransom of 1.5 Bitcoins, about $165,000 at the time of writing, and the incident exposed personal identity data and other PII for numerous individuals and entities.