Ferrari hacked, refuses to pay ransom demand

An unknown threat actor has hacked the Italian luxury automaker Ferrari and is now demanding a ransom in exchange for certain client contact details.

The sports and race car manufacturer announced what it is calling a “cyber incident” on its website Monday.

“Ferrari N.V. announces that Ferrari S.p.A., its wholly-owned Italian subsidiary, was recently contacted by a threat actor with a ransom demand related to certain client contact details,” the statement said.

The company said it will not succumb to the hacker's demands.

“As a policy, Ferrari will not be held to ransom, as paying such demands funds criminal activity and enables threat actors to perpetuate their attacks,” the luxury company said.

“Instead, we believed the best course of action was to inform our clients and thus we have notified our customers of the potential data exposure and the nature of the incident,” Ferrari said.

Considering the typical cost of a Ferrari ranges from more than $200,000 to over $600,000, according to one of the brand's official dealers, clients most likely represent a who's who of the world's wealthiest.

“Ferrari takes the confidentiality of clients very seriously and understands the significance of this incident,” the company said.

"The ransomware attack against Ferrari - which appears to include the exfiltration of sensitive data that exposed client "names, addresses, email addresses and telephone numbers" and potentially other information - highlights the fact that this is not just a ransomware problem, it is a major data loss issue too," said Jon Miller, CEO & Co-founder of cybersecurity firm Halcyon.

Miller said organizations must remember, “the focus for ransomware operators is to cause as much pain as possible for victim orgs (sic) in order to extract the highest payment possible.”

“This means even if the victim org (sic) pays the ransom, the attackers still have the data and can sell or expose it, or come back to the victim org and ask for even more money,” Miller explained.

Based in Maranello, Italy, it appears the automaker was not aware they had been breached until they were contacted by the hacker.

Ferrari said they “immediately started an investigation in collaboration with a leading global third-party cybersecurity firm,” once they became aware of the hacker’s demands.

“Even if Ferrari did everything right with regard to securing the data…and with regard to the incident response measure, the fact is ransomware gangs are intent on stealing data to force victims into paying the ransom demand, and often this means that there is collateral damage to the entities whose sensitive data is exposed.” Miller said.

Miller said even if the organization chooses not to pay the ransom, as in the case with Ferrari, it does nothing to end the financial incentive for ransom attacks.

“Defeating the attack before they can exfiltrate data and before they can disrupt operations is the only way to make these attacks unprofitable,” Miller said.

All of the brands luxury sports cars are made exclusively at the at the Maranello factory – just over 13 thousand new Ferrari’s were produced and sold in 2022.

The automaker said the breach had had no impact on operations.

In October, Ferrari was reportedly hit by a ransomware attack, during which it lost 7GB of data to threat actors.