Morrie's Auto Group Listed by lorenz Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 21, 2022, Morrie's Auto Group was listed on a site operated by the Lorenz ransomware group. The entry states that internal files were taken during a ransomware attack, though the number of people affected and any further details about the incident have not been made public. The listing marks the only confirmed public indication of the event. No statements from the organization or independent verification of the data's contents have been reported.

What happened

Morrie's Auto Group was added to the Lorenz ransomware group's leak site on April 21, 2022. The group claims to have stolen internal data during a ransomware attack.

No information has been released about the timing or method of initial access, the volume of data taken, or whether any ransom demand was issued or met. The number of individuals whose information may be involved remains unknown.

Who is lorenz?

Lorenz is a ransomware operation that became publicly active in early 2021. It follows a double-extortion model in which operators encrypt systems and also remove copies of data, then use a leak site to pressure victims who do not pay.

The group has listed multiple organizations on its site after incidents. Public reporting has documented its use of common initial-access techniques such as compromised remote-desktop services and phishing, followed by deployment of custom ransomware.

About Morrie's Auto Group

Morrie's Auto Group is a regional operator of automobile dealerships. Dealership groups maintain records that include customer identification details, vehicle purchase and service histories, and financing information.

Because these organizations process transactions that often involve credit applications and personal identifiers, they hold data that can remain valuable for extended periods after a vehicle sale or service visit.

What was likely exposed

The only detail provided is that internal files were allegedly exfiltrated. The exact categories of data contained in those files have not been disclosed.

Organizations of this type commonly store customer names, addresses, driver's license numbers, Social Security numbers in financing records, and payment information. Whether any of these data types were present in the exfiltrated files is unconfirmed.

Why it matters

Exfiltrated internal files from an automotive group can contain personal and financial records that retain value for identity fraud or account takeover. The absence of Reported Details leaves affected individuals without clear guidance on specific risks.

For the organization, the listing adds a public record of the incident that may affect customer trust and regulatory scrutiny, even if the full scope of exposure stays undisclosed.

If your data was in this claimed breach

Monitor bank and credit accounts for unusual activity and request free credit reports from the major bureaus. Consider placing a credit freeze if you have no immediate need for new accounts.

Readers can run a free exposure scan of their email address against known breach data to check for appearances in previously published incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.