Europcar dismisses data leak claims as AI fake

The global car rental service has rebuffed data breach claims, saying the Europcar data supposedly posted online could have been generated using ChatGPT.

A recent ad on a popular data leak forum claims attackers are selling personal details belonging to 50 million Europcar clients. The post’s authors claimed to have accessed numerous sensitive details such as usernames, passwords, home addresses, passport numbers, and other details.

However, Europcar denies that the data, which attackers were trying to sell for profit, was taken from the company.

“After being notified by a threat intel service that an account pretends to sell Europcar data on the dark net and thoroughly checking the data contained in the sample, the company is confident that this advertisement is false,” Europcar told Cybernews.

It claims the number of records is inconsistent with what the company actually has, and says that the records themselves are inconsistent. For example, none of the email addresses in the data sample can be found on Europcar’s database.

“The sample data is likely ChatGPT-generated. Addresses don’t exist, ZIP codes don’t match, first name and last name don’t match email addresses, email addresses use very unusual TLDs,” the company said.

The Cybernews research team has also looked into the data sample provided by attackers. According to the team, usernames don’t match email addresses, and the sample contains non-existent ZIP codes.

Moreover, while many individuals whose data is included in the sample were supposedly born in the US, their email domains come from sketchy email services, which is unusual for legitimate car rental service users.

While there’s no way to be sure whether any data was stolen, at least the data sample attackers provided does not inspire confidence in their claims.

Headquartered in the French capital, Paris, Europcar is a global service operating in 140 countries around the globe. The company, which employs nearly 9,000 staff, reported revenue of €1.4 billion ($1.6 billion) in 2022.