DLS Motors Listed by avoslocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In late December 2022, the ransomware group known as avoslocker publicly listed DLS Motors on its leak site and claimed to have taken a substantial volume of the company’s internal files. For employees, customers, suppliers, or anyone whose details may sit inside those systems, the practical stakes are straightforward: personal and business information that was never meant to leave the organisation may now be in the hands of criminals, with no public confirmation yet of exactly whose records were involved or how widely they could spread.

Public detail remains limited. The number of people affected is unknown, and independent verification of the group’s claims has not been published. What is known is the listing itself, the date it was reported, and the group’s assertion that it exfiltrated internal material. That is enough to warrant careful attention from anyone connected to the company.

What happened

On 26 December 2022 it was reported that DLS Motors had been listed by the avoslocker ransomware group. According to the group’s own statement on its leak site, operators claimed: “We downloaded 50GB of internal files from DLS Motors.” The same posting included promotional language about the company’s history, referencing Sobera S.A.’s entry into the Paraguayan market 83 years earlier and its role in local economic activity.

No further technical details—such as the initial access method, the duration of any intrusion, whether encryption was also deployed, or whether a ransom demand was paid—have been disclosed in the available record. The scale of any impact on individuals is listed as unknown. The incident is therefore documented principally through the group’s unverified claim of exfiltration and the public listing of the victim.

Inside avoslocker

Avoslocker is a ransomware operation that emerged in the early 2020s and became known for double-extortion tactics. In this model, operators encrypt systems and simultaneously steal data, then threaten to publish the stolen material on a dedicated leak site if payment is not made. The group has typically operated as a ransomware-as-a-service offering, allowing affiliates to conduct intrusions while the core operators manage negotiation infrastructure and the public leak portal.

Public reporting on avoslocker has described the use of common initial-access routes such as compromised credentials, vulnerable remote-access services, and phishing, followed by lateral movement and bulk data staging before encryption. Victims have spanned multiple sectors and countries. Listings on the group’s site are claims made by the operators; they do not by themselves constitute independent confirmation that every asserted detail is accurate. In the case of DLS Motors, the 50 GB figure and the description of “internal files” originate solely from the group’s own posting.

DLS Motors and its sector

DLS Motors operates in the automotive retail and related services sector. Organisations of this type commonly manage vehicle sales, financing arrangements, parts and service operations, and customer relationship systems. The leak-site text associated the company with Sobera S.A. and its long presence in the Paraguayan market, indicating a business with established local roots and a workforce, supplier network, and customer base that generate substantial internal records.

A breach at an automotive firm is consequential because such companies routinely hold identity documents, contact details, financial and credit information, vehicle ownership and service histories, employee records, and commercial contracts. Even when the precise contents of a theft remain unconfirmed, the category of data these organisations process means that exposure can affect private individuals, staff, and business partners alike.

What data was at risk

The only data description provided in the public record is the group’s claim that “internal files” were exfiltrated in a ransomware attack, with a stated volume of 50 GB. No inventory of file types, no list of affected systems, and no confirmation of specific personal-data categories have been released.

Organisations in the motor trade typically store customer names and addresses, identification and licensing details, payment and financing records, employee personnel files, supplier invoices, and operational documents. Whether any or all of those categories were present in the material avoslocker claims to hold is unconfirmed. Readers should treat the exact contents as undisclosed pending any further official statement.

The real-world impact

For individuals, the primary risks are secondary misuse of personal information—phishing or social-engineering attempts that reference real account or vehicle details, identity fraud, or unwanted contact. Because the number of people affected is unknown, it is impossible to gauge how widely those risks extend. For the organisation, the consequences can include operational disruption, regulatory scrutiny, contractual notifications to partners, and reputational damage, regardless of whether a ransom was paid.

The absence of confirmed victim counts or a detailed data inventory does not eliminate the need for caution; it simply means that anyone with a past or present relationship to DLS Motors should assume their information could have been among the internal files and act accordingly.

What to do if you're exposed

If you have reason to believe your data may have been held by DLS Motors, practical first steps reduce the chance of follow-on harm:

• Monitor bank, credit-card and financing statements for unfamiliar activity and enable transaction alerts where available.
• Treat unsolicited calls, emails or messages that reference the company, vehicles or personal details with heightened scepticism; verify through official channels before responding.
• Change passwords on any accounts that may have shared credentials with company-related services, and enable multi-factor authentication.
• Consider a credit freeze or fraud alert if you live in a jurisdiction that offers those protections and if financial data could be involved.
• Retain any official breach notifications you receive and follow the specific advice they contain.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That check will not confirm or rule out involvement in this specific incident, but it can surface other exposures that warrant the same protective steps.

AICompiled with AI assistance from public sources and published under our editorial standards.