Automaker Stellantis, parent company of major brands such as Citroën, FIAT, Jeep, Chrysler and Peugeot, has confirmed a data breach affecting its customers in North America.
The company announced on Sunday that it had detected unauthorized access to a third-party service provider’s platform that supports its customer service operations. Stellantis has not disclosed the number of customers affected by the incident.
Stellantis: What data is affected?
Stellantis said the investigation is ongoing, but assured that the information exposed was limited to basic contact information. The compromised data includes customer names, addresses, phone numbers and email addresses. The company stressed that no financial details or other sensitive personal data were exposed.
See also: Hackers target ICS computers with malicious scripts
Upon discovery of the incident, Stellantis immediately activated protocols incident response to contain the issue. “Upon discovery, we immediately activated our incident response protocols… and are immediately notifying affected customers,” the company said in a statement to Reuters.
Stellantis has also notified federal authorities and is urging customers to remain vigilantfor potential phishing attempts that may arise from the exposed contact information. The company specifically advised customers to avoid clicking on suspicious links or sharing personal information.
The Stellantis data breach is not an isolated incident but highlights a growing trend of cyberattacks targeting the automotive industry. As automakers increasingly rely on complex digital ecosystems and third-party vendors for everything from cloud services to customer support, their vulnerability to supply chain attacks has increased. Experts note that any supplier with access to customer data represents a potential entry point for malicious actors.
See also: New Botnet Exploits DNS Misconfiguration
Companies like Stellantis, with a presence on several continents and millions of customers, rely on a vast network of partners and providers. This network, which is the core of their efficiency, is also their biggest vulnerability: any third-party supplier can be a “back door” for cybercriminals.
This breach highlights the importance of protecting even “simple” contact information, such as email and phone numbers. For attackers, these are enough to launch targeted phishing campaigns, creating a vicious cycle of losses: first customer trust is damaged, and then future incidents can occur.
This incident follows a recent spate of cyberattacks on other carmakers. Earlier in September, British luxury carmaker Jaguar Land Rover said its manufacturing operations were “severely disrupted” by a cybersecurity incident. Its UK factories were forced to shut down until September 24. Similarly, companies such as Toyota and Honda have dealt with their own security problems through suppliers, underscoring that supply chain vulnerabilities pose a threat to the entire industry.
The increase in cyberattacks (up 50% by early 2025) continues to erode consumer trust, a critical element for automakers in an increasingly connected and competitive market.
See also: Apple fleets: AI phishing attacks make identity security a priority
Stellantis – like other major manufacturers – faces a critical contradiction: to remain competitive, it is investing in smart vehicles, cloud services and digital customer experiences. But this strategy multiplies the potential points of attack. When an incident like this reaches the public, the stakes are not only the security of data, but also the image of the company in a market where trust equals sales.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
More broadly, such breaches show that the automotive industry needs a new security philosophy. Protecting its own systems is not enough; it requires rigorous assessment and ongoing monitoring of partners, with cybersecurity practices embedded throughout the chain. Otherwise, every Stellantis, Toyota or Jaguar Land Rover will remain exposed in a battlefield where attacks are becoming increasingly frequent and sophisticated.
