85GB of Sensitive Data Leaked from Ibericar

Data Breach Summary

On January 30, 2025, the Monti ransomware group published 85GB of stolen data from Ibericar, a leading automotive distributor in Spain, on their dark web leak site. The breach followed a ransomware attack in which Ibericar reportedly refused to pay or negotiate, prompting the attackers to expose the compromised files.

This leak has drawn serious attention due to the scale and sensitivity of the information disclosed, which includes customer and business documents, financial records, and personal identification data.

Where and How?

The breach was disclosed on the Monti ransomware gang’s dark web leak portal, a common tactic used by ransomware operators to pressure victims. The leaked dataset—approximately 85GB in size—reportedly contains:

• Customer contracts and invoices
• Confidential company documentation
• Scanned passports and IDs
• Financial statements and internal communications

The attack targeted Ibericar’s internal systems, exfiltrating data before encryption. The group followed its typical double extortion method: demanding ransom and threatening to leak the data if ignored—which is exactly what happened.

Company Data Breach History

As of now, there is no widely known history of prior public data breaches involving Ibericar. However, this large-scale ransomware attack shows that even companies with limited prior incidents are at significant risk, especially in sectors like automotive retail that often handle extensive customer and financial data.

This event highlights the growing trend of ransomware groups like Monti, who have previously targeted healthcare and infrastructure sectors, now expanding their focus to major private enterprises.

Further Action

Cybersecurity experts urge Ibericar and affiliated partners to:

• Conduct a full forensic audit of their systems.
• Notify all individuals whose personal data may have been compromised.
• Reinforce security infrastructure, especially around data backups and network segmentation.
• Increase employee awareness around phishing and ransomware vectors.

Recommendations for Personal Data Protection

How Users Can Protect Their Information
To safeguard personal information and accounts, users should consider the following steps:

• Change Passwords Regularly: Use strong, unique passwords combining letters, numbers, and symbols.
• Enable Two-Factor Authentication (2FA): Whenever possible, activate 2FA to add an extra layer of security to accounts.
• Use Unique Passwords for Each Account: Avoid reusing passwords across different platforms to prevent multiple account compromises.
• Be Cautious of Phishing Attempts: Stay vigilant against suspicious emails or messages that may contain malicious links or solicit personal information.
• Monitor Accounts for Unusual Activity: Regularly review account statements and activities to detect and respond promptly to unauthorized actions.

By adopting these practices, users can enhance their personal data security and reduce the risk of unauthorized access to their information.

What is InsecureWeb?

InsecureWeb is a Dark Web monitoring service that keeps track of recent data breaches and tracks their impact by monitoring the darkest places of the internet.

Our commitment lies in providing top-notch cybersecurity services to our clients. Through continuous monitoring of the dark web and advanced threat detection methodologies, we strive to identify potential breaches promptly, enabling swift response and mitigation efforts. With our state-of-the-art tools and expertise, we prioritize the confidentiality, integrity, and availability of our clients’ data.