OneDealer Listed by hellcat Ransomware Group

On February 25, 2025, the hellcat ransomware group listed OneDealer on its leak site after exfiltrating more than 330,000 records from the automotive software provider and its partners. The exposed data includes sales reports, customer leads, vehicle details with VINs and license plates, and other internal files belonging to dealerships and manufacturers such as AutoHellas, AutoBesikos, KosmoCar, AWT, Karenta AE, QA, Proaxia, Hyundai, BMW, Audi, and Kia. Anyone who bought or serviced a vehicle through these companies in recent years may have personal information now in attackers’ hands.

What's Publicly Reported from Reporting

Public reporting indicates the breach stems from a ransomware attack on OneDealer, a platform used by multiple European automotive partners to manage sales, leads, and customer records. The hellcat group claims to have downloaded the files before encrypting systems and has published a sample on its leak site. Available reporting describes the dataset as containing customer contact details, purchase histories, and vehicle identification information. No confirmed total number of unique individuals affected has been released, but the volume of records suggests widespread exposure across several major brands.

February 25, 2025 marks the date the group added OneDealer to its public extortion page. The leak site continues to display samples and threatens further publication if demands are not met.

Why This Matters for You and Your Family

If you or anyone in your household has purchased or leased a car from the listed dealerships, your name, address, phone number, email, and vehicle registration details may now be available to criminals. This kind of information is valuable because it can be used to craft convincing phishing emails, impersonate dealership staff, or combine with other stolen data to commit identity theft or financial fraud. For families, the risk extends beyond the primary buyer: shared addresses and phone numbers mean spouses and children can also become targets for follow-on scams.

Vehicle-related records are especially sensitive. License plates and VINs can be cross-referenced with public databases to locate where you live or work. Once criminals have that foothold, they can pursue everything from insurance fraud to physical stalking.

The Doxxing and Identity-Chain Implications

A single breach like this rarely stays isolated. Attackers routinely feed stolen customer records into automated tools that link emails, phone numbers, and addresses to usernames on social media, gaming platforms, and other services. What begins as a dealership record can quickly become a complete profile containing your children’s names, school details, or gaming handles. Credential leaks of this nature often cascade into account takeovers on email, banking, or gaming platforms that reuse the same passwords.

When real identity data connects to online handles, the result is doxxing chains that expose families to harassment, swatting, or targeted social engineering. Public reporting shows these ransomware operators frequently sell or publish full datasets, giving other criminals easy access to the same information.

Hellcat Ransomware Group Track Record

Public reporting attributes the attack to the hellcat ransomware group, which emerged in late 2023. The group has targeted mid-sized businesses across Europe and North America, with prior victims including logistics firms, manufacturers, and software providers. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by exfiltration of sensitive files before deploying ransomware. Hellcat then uses dual extortion: threatening both data encryption and public leaks unless payment is made. They maintain an active leak site where they post victim names and sample data to increase pressure.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate any password you ever used at OneDealer or its partner dealerships, and enable 2FA through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught and addressed in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which frequently become entry points when credential leaks cascade into takeovers and doxxing chains.
• Let remediation specialists handle takedown requests across data brokers and leak sites while you focus on securing your own accounts and monitoring statements for unusual activity.

The incident shows how quickly personal data from everyday transactions can reach criminals who specialize in turning one leak into many. Taking deliberate steps now limits the damage and reduces the chance that your family becomes the next link in an identity chain. Start your DoxxScan trial and let its continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage—including children’s gaming accounts—work on your behalf.