Ransomware group SETTRA behind cyberattack on Israel’s largest car importer
Sources familiar with the incident say the group threatened to publish Colmobil customers’ personal details unless a ransom was paid. The attack disrupted the importer’s operations and led the Transport Ministry to block its access to a vehicle-registration system.
The ransomware group SETTRA was behind the cyberattack on Colmobil, Israel’s largest vehicle importer, Calcalist can now reveal, exactly two weeks after the attack was first reported.
Two weeks ago, Calcalist reported that Colmobil had notified its business partners of a security incident. The notice stated: “A few hours ago, a cybersecurity incident was identified by the company’s technology team. The company had prepared for such an event; it is currently investigating the source of the incident with the help of dedicated teams and has notified the relevant regulatory authorities. The situation is being managed, and the company is working to resolve it as quickly as possible.”
SETTRA specializes in so-called double extortion, a ransomware tactic in which attackers steal data and encrypt files, restricting the victim’s access to its own systems while threatening to publish the stolen information. According to international reports, the group typically threatens to release customer data if its demands are not met.
Sources familiar with the Colmobil incident said SETTRA threatened to publish the importer’s customers’ personal details online unless a ransom was paid. Colmobil declined to comment on whether it had paid the ransom.
According to international reports, SETTRA does not target critical infrastructure or government entities. The group reportedly tells victims that their data will not be leaked if they pay the ransom. Its previous targets have included organizations in the financial, healthcare and retail sectors.
The attack disrupted Colmobil’s operations. In response to the incident, the Ministry of Transport blocked the company’s access to the system vehicle importers use to complete procedures required to register new vehicles.
Israeli organizations that suffer cyberattacks may be required to report them to the relevant authorities, depending on the applicable regulatory framework. In this case, the National Cyber Directorate was notified, according to the company’s initial statement.
Colmobil is a major player in Israel’s automotive market, importing vehicles from brands including Germany’s Mercedes-Benz, South Korea’s Hyundai, Japan’s Mitsubishi, and China’s ORA and Jaecoo, among others. According to data from the Israel Vehicle Importers Association, Colmobil delivered 62,657 new vehicles in the first nine months of the year, accounting for 24.5% of the market.
The company’s scale makes its reliance on computerized systems particularly significant. Vehicle imports involve a chain of digital processes, including handling, tax payments, financial settlements, licensing and payment processing. Disruptions to these systems can therefore affect operations well beyond the company’s internal IT environment.
Identifying the incident as a ransomware attack helps clarify the nature of the breach, although it does not by itself establish how the attackers initially gained access. Other potential attack routes in the automotive sector include compromised software updates, connected vehicle infrastructure and computers linked to vehicle diagnostic ports. Last year, the Ministry of Transport published an initial draft of cybersecurity requirements for vehicle importers.
Colmobil said: “The company has returned to full operation. No information has been exposed to the public. Colmobil is operating with complete transparency and is taking all necessary measures to protect its customers.”
