Ferrari hacked; doesn’t pay $1 million ransom demand

Not only was Ferrari dealing with grid penalty and car development problems with their F1 car this past week, but it now seems they were also dealing with a cybersecurity incident.

Ferrari has revealed that it was the victim of a data breach and extortion demand. The firm’s email to customers, reproduced below, states that customer names, addresses, email addresses, and telephone numbers may have been acquired by the threat actors. There is no indication that any customer financial data or corporate intellectual property was stolen.

“As a policy, Ferrari will not be held to ransom as paying such demands funds criminal activity and enables threat actors to perpetuate their attacks,” Ferrari stated in their press release.

Nor, according to someone with knowledge of the incident, did Ferrari ever respond to the threat actors at all. The source informs DataBreaches that the demand had given Ferrari until March 21st to pay. Instead, Ferrari went public with the situation and demand on March 21.

A number of sites have reported this incident as a ransomware attack. According to the same source, there was no locker or ransomware involved at all. It was a hack with exfiltration and an extortion demand. The source was unable to tell DataBreaches with any certainty how the threat actors gained access, but did indicate that this incident had nothing to do with an earlier Ferrari incident by Everest Team.

The initial ransom demand was $1 million, according to the source, and DataBreaches understands that the data may have already been sold to another threat actor for a lesser amount, but DataBreaches has not seen any proof of any such sale.

Update to add comment that this was unrelated to earlier attack by Everest.