• Hacker breaches Europcar’s GitLab repos.
• Attempt to steal mobile app source code and personal data of 200,000.

A hacker has accessed the GitLab repositories of Europcar Mobility Group, extracting source code for the company’s Android and iOS applications, along with personal data linked to tens of thousands of customers.

The attacker claimed responsibility in late March, stating they had exfiltrated more than 9,000 SQL files and 269 environment configuration files (.env), which are typically used to store application settings and sensitive information. Screenshots of stolen credentials were posted to support the claim.

The breach was verified by BleepingComputer, and has impacted multiple parts of the company’s codebase, although some repositories were reportedly untouched.

Europcar Mobility Group, which operates brands Europcar, Goldcar, and Ubeeqo, is currently evaluating the full scope of the incident.

Preliminary assessments suggest that names and email addresses belonging to Goldcar and Ubeeqo users were among the stolen data. No financial information, passwords, nor biometric details appear to have been exposed. The company estimates the number of affected customers may range from 50,000 to 200,000, with some records dating back to 2017 and 2020.

Europcar has informed data protection authorities and is notifying the users whose data was included in the theft. How the threat actor gained access remains unclear, although similar breaches often stem from stolen credentials harvested by infostealer malware.

The actor reportedly attempted to extort Europcar by threatening to leak approximately 37GB of data, which allegedly includes internal backups, infrastructure documentation, and application source code.

False breach claim circulated on hacker forum

This is not the first time Europcar has been the subject of a cybersecurity-related claim. In 2023, a user on a popular hacker forum claimed to be selling personal data for more than 48 million Europcar customers. The post included samples with names, addresses, birth dates, and driver’s licence numbers. However, Europcar confirmed later that the alleged breach was fabricated. After analysing the shared sample, the company stated that the data did not match its records. Europcar said the sample appeared to contain non-existent addresses, mismatched names and emails, and unusual domain extensions – indicators that the data was fake. Europcar attributed the sample to potential use of artificial intelligence tools, though not all experts agree.

Troy Hunt, founder of Have I Been Pwned, said at the time that while the dataset was clearly fabricated, the evidence didn’t suggest it was AI-generated. He said fabricated breaches are not new and are often created to attract attention or money.

Security researcher NexusFuzzy also stated that tools already exist to generate fake but realistic-looking personal data, making such scams easy to orchestrate.

Security experts weigh in

Martin Reynolds, Field CTO at software delivery platform Harness, described the recent breach as a reminder of the risks associated with unsecured code repositories.

“GitLab repositories contain a treasure trove of information, including proprietary code, customer details, and insight into a company’s infrastructure. This can fetch a high price online, sold to cybercriminal groups who can now look to use the information to carry out targeted attacks against the organisation and its customers.”

He said that stolen developer credentials are a common attack vector: “All it takes is one user to fall victim to an infostealer or phishing attack, and entire repositories can quickly become accessible through their stolen credentials.”

Reynolds spoke of the importance of applying minimal permissions, automated scanning, and secure software development practices: “Organisations must ensure that their repositories are protected by minimal token permissions, so only users who should have access can perform actions like editing or downloading new code. [..] Organisations must automate scans at the moment developers add to source code repositories. This will ensure that any company data isn’t exposed in the event of a breach.”