Discount Car and Truck Rentals Listed by darkside Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People whose information is held by car rental companies often share sensitive details such as driver’s licence numbers, addresses, payment card data and travel itineraries. When such an organisation appears on a ransomware group’s leak site, those individuals face the possibility that their records have left the company’s control, even if the scale and contents of any theft remain unknown. On 1 February 2021, Discount Car and Truck Rentals was listed on the leak site operated by the darkside ransomware group. The group stated that it had obtained internal files during a ransomware incident. No figure for the number of people affected has been published, and the company has not confirmed the extent or nature of any data removal.

What happened

The only public record of the incident is the listing itself. The darkside group asserted that it had exfiltrated internal files; no independent verification of that claim or of any subsequent publication of material has been reported. Timing of the underlying intrusion, the method used to gain access, and whether files were encrypted or merely copied are not stated in available information.

Who is darkside?

Darkside is a ransomware group that operated a ransomware-as-a-service model between 2020 and 2021. It supplied encryption tools to affiliate attackers in exchange for a share of ransom payments and maintained a public leak site where it listed victims and threatened to release stolen data. The group’s tactics typically combined encryption of systems with the removal of files for later leverage, a practice sometimes called double extortion. Its infrastructure was later disrupted by law-enforcement action, after which the group ceased visible operations.

Who is Discount Car and Truck Rentals?

Discount Car and Truck Rentals is a Canadian vehicle-rental company serving both individual and commercial customers. Organisations of this type routinely collect and store driver identification, contact details, vehicle usage records and financial information required to complete rentals and manage fleets. A compromise at such a firm can therefore involve data that directly identifies customers and links them to specific journeys or payment methods.

What data was at risk

The listing refers only to “internal files.” No inventory of specific data types or record counts has been released. Rental companies commonly hold names, addresses, driver’s licence details, insurance information and payment card data; however, whether any of these categories were among the files referenced by the group remains unconfirmed.

The real-world impact

Individuals named in any exfiltrated records could see their details appear on criminal forums or be used for identity-related fraud or targeted scams. For the organisation, the incident adds to the operational costs of incident response, potential regulatory scrutiny and the need to review access controls and third-party connections. Because the number of affected records and the status of any data release are still unknown, the full scope of these consequences cannot yet be measured.

What to do if you're exposed

Anyone who has rented from the company in recent years should monitor bank and credit-card statements for unusual activity and consider placing fraud alerts with credit-reporting agencies. Changing passwords for any accounts that reuse rental-site credentials is a prudent step. Readers can also run a free exposure scan of their email address against known breach data sets to check whether their information has appeared in other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.