Ford Motor Company SA de CV Data Breach

Ford Motor Company, S.A. de C.V., a manufacturing entity based in Mexico, was publicly listed as a victim by the Krybit ransomware group on their dark web portal on June 28, 2026. This detection was made possible by SOCRadar’s Dark Web Monitoring service. The organization operates within the manufacturing sector, specifically in the automotive-industrial domain. Krybit has been active in targeting businesses in the business services, public sector, and technology sectors, with recent victims concentrated in Germany, Mexico, and Peru.

SOCRadar’s analysis revealed a significant exposure for the `ford.mx` domain through stealer-log telemetry. A sample containing 25 records, predominantly customer-facing credentials from endpoints like `sso.ci.ford.mx` and `login.ford.mx`, was identified. The exposure primarily involved customer account-takeover and supplier risk, with data freshness dating between June 19 and June 27, 2026. No corporate employee credentials were found in this specific sample, but this does not preclude their existence in the broader dataset. The observed credential harvesting aligns with typical initial access methods for ransomware groups like Krybit, where compromised credentials from underground marketplaces are used to access corporate networks. CTI teams are advised to enhance monitoring and implement credential hygiene measures, including a comprehensive review of corporate-domain credentials.

Disclaimer

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.