Stellantis customer data breach

❗Article Status Notice: This Article is a stub

---

This article is underdeveloped, and needs additional work to meet the wiki's Content Guidelines and be in line with our Mission Statement for comprehensive coverage of consumer protection issues. Learn more ▼

Issues may include:

• This article needs to be expanded to provide meaningful information
• This article requires additional verifiable evidence to demonstrate systemic impact
• More documentation is needed to establish how this reflects broader consumer protection concerns
• The connection between individual incidents and company-wide practices needs to be better established
• The article is simply too short, and lacks sufficient content

How you can help:

• Add documented examples with verifiable sources
• Provide evidence of similar incidents affecting other consumers
• Include relevant company policies or communications that demonstrate systemic practices
• Link to credible reporting that covers these issues
• Flesh out the article with relevant information

This notice will be removed once the article is sufficiently developed. Once you believe the article is ready to have its notice removed, please visit the Moderator's noticeboard, or the Discord (join here) and post to the #appeals channel, or mention its status on the article's talk page.

Stellantis customer data was exposed in a breach through a third-party platform on September 21, 2025. The hackers accessed contact information of customers in North America.

Background

The Bleeping Computer reports that the ShinyHunters group accessed Stellantis data as part of a larger effort targeted at Salesforce, which included data stolen from many other large companies in 2025, such as Google, Cisco Systems, Inc., and Workday. The group did not reveal to Bleeping Computer the methods used to gain access in this incident, however, their tactics in the similar attacks on Salesforce included social engineering and stolen credentials that allowed access through the Salesloft Drift AI chat integration with Salesforce.

Customer data breach

On September 21, 2025, Stellantis North America reported the data breach on their website. They stated that the data was limited to contact information and that the breach did not involve any financial or sensitive personal information. They did not include an estimate of impacted customers. Bleeping Computer reported that extortion group ShinyHunters took credit for the breach, stating that they stole over 18 million Salesforce records pertaining to contact information.

Stellantis's response

In their initial report, Stellantis North America remarked on their response to the incident:

Upon discovery, we immediately activated our incident response protocols, initiated a comprehensive investigation, and took prompt action to contain and mitigate the situation. We are also notifying the appropriate authorities and directly informing affected customers.

Consumer response

Some consumers reacted to the news of the data breach in the context of the broader conversations around privacy concerns in the automotive industry and the proposed REPAIR Act (H.R. 906) legislation in the United States. Online comments from consumers include criticism towards Stellantis for characterizing Right to repair as a security vulnerability while failing to keep their customers' contact info secure, expressions of gratitude for owning vehicles from the early 2000's and older that don't collect consumer data to begin with, and statements of distrust in Stellantis and a lack of surprise at the incident.

See also

• Ticketmaster Entertainment, LLC - ShinyHunters data breach
• Volkswagen car-location data-exposure incident