Ransomware victim disclosure
← All victimsCarNet
Claimed by Stormous · listed 2 months ago
Status timeline
- Listed
Mar 30, 2026
- Data leaked
At a glance
- Group
- Stormous
- Status
- Data leaked
- Country
- United States
- Sector
- Automotive
- Listed on leak site
- Mar 30, 2026
- Data size
- 33 GB
- Ransom demanded
- $900
About the victim
AI dossier — public-source company profileCarNet appears to be an automotive-sector company, likely involved in connected vehicle services, fleet management, or automotive dealer/production tracking, based on the nature of the breached data (production orders, delivery tracking, client records). No public site was available to confirm further details. The company is listed as US-based.
- Industry
- Automotive Fleet / Vehicle Tracking & Management
Attack summary
Severity: high — Confirmed exfiltration of 33 GB of data including PII (customer names, identification numbers) and sensitive business records (production orders, client records, delivery tracking), with data published; though not at the scale of regulated medical or financial data, the combination of PII and operational business data at confirmed exfiltration warrants high severity.Stormous claims to have breached CarNet's internal systems, accessing and exfiltrating approximately 33 GB of data including customer records, production orders, and delivery tracking information. The data has been published or offered for sale per the disclosed status.
Data the group says was taken
AI dossier — extracted from the leak post- Customer names
- Identification numbers
- Production orders
- Client records
- Delivery tracking data
- Customer information
- Company logos
- Internal documents
What the group claims
Customer names, identification numbers, production orders, client records, delivery tracking data, customer information, logos
The leak post
captured from the group's siteInitial Access Brokers - Long-Term Collaboration We are currently seeking reliable Initial Access Brokers for long-term collaboration. ** Please do not waste time attempting complex exploit development or direct EDR confrontation. We are interested exclusively in stable corporate access. Local user access is acceptable. * Small to mid-sized enterprises: fixed payment starting at * Large enterprises: revenue share from final settlement FANASA.COM Half the data has been extracted Personally Identifiable Information (PII), Electronic Fiscal Documents (CFDI/XML), Financial Transaction Records, Commercial Invoices & Billing Data, Taxpayer Identification Numbers (RFC), Client & Vendor Database/Internal Corporate Documentation Administrative/System Files/ADMIN, DOAS, operational records, engineering drawings, schematics... Project Planning & Execution Documents... (Folders/Files) Email/Communication/System/Application Data AYEAPLICACIONES database/Log Data BDATOSFITCLOD, Software/Installation/Program Files AUTOBOU, Personal/Miscellaneous Files AvenaCubana All of this data is offered for sale (user information: email, phone number, full name, date of birth / payment and bookin…
Data the group says was taken
- PII
Sources
Source
Indexed 2 months agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
