Harbor Truck Sales Data Breach

Harbor Truck Sales, a commercial truck dealership, was listed on the Settra ransomware group’s dark web leak site on October 2, 2026, with claims of corporate data exfiltration. Truck dealerships are attractive targets due to the sensitive customer financial data they handle, including financing applications, credit histories, purchase contracts, and fleet ownership records for business clients. This type of information is particularly valuable for ransomware operations employing double extortion tactics. Settra has focused its recent activities over the past 60 days on the automotive and commercial vehicle sectors. The dealer management system (DMS) ecosystem is recognized as a potential vulnerability. Compromises of DMS providers in previous years have demonstrated that dealerships concentrate high-value financial data and rely on tightly integrated third-party systems. Settra’s double extortion model aligns with the cybersecurity obligations, such as the FTC Safeguards Rule, that auto dealers are required to adhere to.

SOCRadar’s stealer-log query for Harbor Truck Sales did not yield any results. Potential initial access vectors for this incident could include phishing campaigns, exploitation of vulnerabilities within Dealer Management Systems (DMS) or Customer Relationship Management (CRM) platforms, or a compromise originating from a financing provider or original equipment manufacturer (OEM) integration. Truck dealerships typically integrate their DMS with manufacturer inventory systems, financing portals, and fleet management tools, which can expand the attack surface beyond the dealership’s immediate network perimeter. The lack of stealer-log records does not confirm that the organization is unaffected. It is crucial to consider that credentials may exist under alternate corporate domains, use personal email aliases, or might have been used and rotated before indexing in the queried datasets. Furthermore, records could reside in feeds outside the scope of the specific query, and data may not have been indexed yet. Therefore, the absence of evidence in this specific query is not evidence of the absence of a compromise. Given the sensitive nature of customer financial data typically stored in dealer management systems, potential access to financing or personal financial records could trigger obligations under the FTC Safeguards Rule and relevant U.S. state privacy laws, necessitating a review for breach notification. Organizations should engage incident response, audit DMS and CRM access logs for unauthorized activity, review the security of all OEM and financing system integrations, and enforce multi-factor authentication across all remote access pathways.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.