Johnson City Honda Data Breach

Global Secret Group ransomware has claimed Johnson City Honda, an automotive retail dealership located in the United States, as a victim. The listing appeared on the ransomware group’s dark web portal on August 25, 2026, and was detected by SOCRadar’s Dark Web Monitoring. The potential impact on Johnson City Honda could involve sensitive customer data, vehicle inventory systems, financing records, and service management infrastructure. In the 60 days preceding this listing, Global Secret Group claimed 13 other victims. Their primary targeted sectors include Other, Retail and E-Commerce, and Manufacturing, with a notable concentration of victims in the United States. Recent victims with similar profiles in the retail sector or based in the US include 4M REALTY COMPANY, Lockheed Architectural Solutions, Tiseo Paving, and The Rubber Group. Johnson City Honda aligns with Global Secret Group’s documented pattern of targeting US-based retail and commercial entities across various industries like automotive, real estate, and construction.

A query into stealer-log telemetry for johnsoncityhonda[.]com returned no records. It is important to note that the datasets queried are paginated and sampled. Therefore, the absence of records does not definitively rule out a compromise. Credentials may have surfaced in feeds that were not queried, could have been rotated before indexing by threat actors, or might have been harvested through personal email aliases not directly associated with a corporate domain. Infostealer-harvested credentials frequently serve as an initial access vector for groups like Global Secret Group. Threat actors often acquire these credentials from underground markets via brokers, validate them for corporate account access, and subsequently use them to gain entry through platforms such as Microsoft 365, VPNs, or remote-access portals before deploying ransomware. While this specific query yielded no direct evidence, a null result is not an indicator of security. Threat intelligence teams should continue monitoring for related activities and perform proactive credential hygiene checks.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.