Lucidmotors Data Breach

Lucidmotors, a transportation organization based in the United States, has been listed as a victim on the Sovcali ransomware group’s dark web portal, with the listing published on August 9, 2026. This listing was identified through SOCRadar’s Dark Web Monitoring service. Based on the sector and country data captured for the listing, the organization operates in the transportation space within the United States. It joins a pattern of recent Sovcali listings that CTI teams have been tracking across the group’s leak portal. In the 60 days prior to this listing, Sovcali claimed one other victim across its leak portal, indicating a comparatively low-volume cadence for the group. Available listings from Sovcali skew towards the Transportation sector and toward United States-based organizations. Lucidmotors aligns with this observed targeting pattern.

Initial access correlation against SOCRadar’s stealer-log telemetry surfaced a significant exposure for the lucidmotors.com domain. The queried data returned two confirmed employee credentials (category A) that accessed the corporate domain and third-party SaaS platforms, one workstation-compromise indicator (category C), and approximately twenty-one external-user accounts on company-owned URLs. This combination of corporate and workstation compromise indicators suggests a mixed intrusion profile. The most recent logs associated with this exposure carry August 2026 insert dates. SOCRadar’s automated stealer-to-ransom analysis, which has been paraphrased here, identifies these findings; the underlying records containing masked usernames, partial passwords, or raw URLs are not published. For ransomware groups like Sovcali, infostealer-harvested credentials represent a well-documented initial access vector. Threat actors or initial access brokers often source fresh logs from underground marketplaces, validate the corporate credentials, and then use them to gain access to platforms such as Microsoft 365, VPNs, or remote-access portals before deploying ransomware. While the stealer-log evidence identified in this instance does not definitively confirm that these specific credentials were used by Sovcali, the pattern is consistent with the typical kill chain observed for this class of incident. Given the potential for credential compromise and its role in ransomware operations, immediate actions for responders should include credential rotation and session-token invalidation. Continued dark web and stealer-log monitoring is also advised to detect any further related activity or exposure.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.