• ITVI.USA
    11,367.920
    -1,484.510
    -11.6%
  • OTLT.USA
    3.515
    0.122
    3.6%
  • OTRI.USA
    20.260
    0.880
    4.5%
  • OTVI.USA
    11,347.230
    -1,482.560
    -11.6%
  • TSTOPVRPM.ATLPHL
    2.580
    -0.120
    -4.4%
  • TSTOPVRPM.CHIATL
    3.550
    0.030
    0.9%
  • TSTOPVRPM.DALLAX
    1.300
    0.010
    0.8%
  • TSTOPVRPM.LAXDAL
    3.710
    0.060
    1.6%
  • TSTOPVRPM.PHLCHI
    2.140
    -0.010
    -0.5%
  • TSTOPVRPM.LAXSEA
    4.100
    -0.100
    -2.4%
  • WAIT.USA
    136.000
    -3.000
    -2.2%
  • ITVI.USA
    11,367.920
    -1,484.510
    -11.6%
  • OTLT.USA
    3.515
    0.122
    3.6%
  • OTRI.USA
    20.260
    0.880
    4.5%
  • OTVI.USA
    11,347.230
    -1,482.560
    -11.6%
  • TSTOPVRPM.ATLPHL
    2.580
    -0.120
    -4.4%
  • TSTOPVRPM.CHIATL
    3.550
    0.030
    0.9%
  • TSTOPVRPM.DALLAX
    1.300
    0.010
    0.8%
  • TSTOPVRPM.LAXDAL
    3.710
    0.060
    1.6%
  • TSTOPVRPM.PHLCHI
    2.140
    -0.010
    -0.5%
  • TSTOPVRPM.LAXSEA
    4.100
    -0.100
    -2.4%
  • WAIT.USA
    136.000
    -3.000
    -2.2%
CybersecurityNewsOEMTop StoriesTrucking

Navistar data leaked on auction site after cyberattack

Dark web marketplace claims to be auctioning off hundreds of gigabytes of stolen files

Data apparently stolen from Navistar International Corp. has been leaked onto the dark web, exposing detailed financial information less than a month after the heavy truck and military vehicle manufacturer disclosed a cyberattack. 

The data appeared on Wednesday on Marketo, which bills itself as a marketplace for stolen data. It consists of 82 files — which appear authentic — and the site’s operators offered it as a preview for a 330-gigabyte trove being made available for auction.

The portion posted included detailed financial statements, contracts and other internal documents. Marketo, which isn’t accessible through standard internet browsers, claimed that the full leak being sold also included data from partners and customers.

The leak came less than a month after Navistar disclosed a cyberattack and data breach in a Securities and Exchange Commission filing on June 7, and a day before its merger with Volkswagen AG’s TRATON SE took effect on Thursday. 

Navistar (NYSE:NAV) issued a statement in response to FreightWaves’ questions about the posting of stolen data, saying it “is aware of a security incident that affected our company’s systems” and that its investigation has confirmed “that an unauthorized third party accessed and took certain data from our IT System.”

Navistar did not respond to specific questions about the leak, nor confirm the data’s authenticity or that it resulted from the previously disclosed attack, which occurred in May. 

“The investigation is ongoing, and we have taken proactive steps to help minimize the potential impact,” the company said. “Navistar is committed to systems security and the protection of our corporate, customer, dealer, employee and partner information, and we take this responsibility seriously.” 

Leak site reportedly markets stolen data to victims’ competitors

Little is known about Marketo, which came online earlier this year. But the cybersecurity website BleepingComputer recently reported that Marketo’s tactics include attempting to sell data to victims’ competitors directly. 

Brett Callow, a threat analyst with cybersecurity software firm Emsisoft, said the site appears to sell data that its operators have stolen themselves as well as data taken by others, including ransomware gangs.

In contrast to instances in which ransomware gangs leak stolen data to their own sites after victims refuse to pay them, the appearance of Navistar’s files on Marketo sheds little light on the original attack, Callow said. 

“It could have been just plain old hacking,” Callow said.

Josh Lospinoso, co-founder and CEO of Shift5, a cybersecurity firm specializing in protecting heavy military and civilian vehicles, including trucks, agreed that the data leak provided few clues about what happened to Navistar and said the attack was part of an alarming trend. 

“Unfortunately, we’re seeing fleet and critical infrastructure operators getting hit with increasing regularity,” Lospinoso wrote in an email. “As operators take advantage of technological innovations that allow them to operate more efficiently, they’re often increasing connectivity. This creates reliance on IT systems for normal business operations, and the result is that criminals are finding some of these systems exploitable. 

FreightWaves’ Detroit Bureau Chief Alan Adler contributed to this report. 

Read more

Click for more FreightWaves articles by Nate Tabak

Nate Tabak, Border and North America Correspondent

Nate Tabak is a Toronto-based journalist and producer who covers cybersecurity and cross-border trucking and logistics for FreightWaves. He spent seven years reporting stories in the Balkans and Eastern Europe as a reporter, producer and editor based in Kosovo. He previously worked at newspapers in the San Francisco Bay Area, including the San Jose Mercury News. He graduated from UC Berkeley, where he studied the history of American policing. Contact Nate at ntabak@freightwaves.com.

We are glad you’re enjoying the content

Sign up for a free FreightWaves account today for unlimited access to all of our latest content

By signing in for the first time, I give consent for FreightWaves to send me event updates and news. I can unsubscribe from these emails at any time. For more information please see our Privacy Policy.