Data breach at BMW caused by an attack on an external supplier

On September 14, 2025, the Everest ransomware cybercriminal group claimed responsibility for the data breach at German car manufacturer BMW via its leak portal. According to the group, they had managed to steal confidential company documents and announced that they would publish more sensitive information within 48 hours if negotiations did not begin.

Three days later, on September 17, having received no response from BMW, Everest updated its post. In it, they stated that approximately 600,000 lines of internal BMW documents had been extracted, including internal audit reports, engineering designs and specifications, and communications from company executives.

BMW officially confirmed that the incident had occurred due to a data breach at an external supplier located in the United States. The company assured that its own internal systems had not been compromised, but acknowledged that it had been affected by the breach and was taking steps to protect the information and minimize the impact.