Automotive giant Stellantis has just revealed that it suffered a data breach, exposing customer contact details, after attackers infiltrated a third-party platform used for North American customer services. The announcement comes at a time when large-scale attacks on cloud CRM systems have already shaken tech and retail sectors alike, with Salesforce clients such as Google, Allianz, and Dior reporting similar intrusions. These earlier incidents exposed names, emails, and phone numbers, which were sufficient for attackers to launch phishing campaigns or extortion attempts.
What you need to know about the Stellantis breach
Stellantis was formed in 2021 through the merger of the PSA Group and Fiat Chrysler Automobiles. Today, it ranks among the world’s largest automakers by revenue and is fifth in volume globally. The company houses 14 well-known brands, including Jeep and Dodge, as well as Peugeot, Maserati, and Vauxhall, and operates manufacturing infrastructure across more than 130 countries. That global scale naturally makes it a tempting target for cyber adversaries.
In its public statement, Stellantis clarified that only contact information was taken. Since the compromised third-party platform does not host financial or deeply sensitive personal data, Stellantis asserts that social security numbers, payment details, or health records were out of reach of the attackers. In response, the company activated its incident response protocols, launched a full investigation, contained the breach, notified authorities, and began alerting affected customers. It also issued warnings about phishing and urged customers not to click suspicious links.
Stellantis has not revealed how many customers the breach affected. The company also has not specified which contact fields, such as email, phone, or address, attackers accessed.
Credit: Stellantis
The alleged culprit, ShinyHunters, and Salesforce breaches
While Stellantis has not explicitly named the hacker group behind the breach, multiple sources tie this incident to the ShinyHunters extortion campaign, which has spearheaded a wave of data thefts targeting Salesforce this year.
ShinyHunters claims to have stolen over 18 million records from Stellantis’ Salesforce instance, which includes names and contact details, according to Bleeping Computer. These attacks form part of a broader campaign aimed at Salesforce customers. In recent months, ShinyHunters has often worked in concert with groups like Scattered Spider and targeted companies including Google, Cisco, Adidas, Allianz Life, Qantas, and brands under LVMH such as Dior and Tiffany & Co.
Their reported method is fairly ingenious. Attackers exploit OAuth tokens tied to integrations like Salesloft’s Drift AI chat tool to pivot into Salesforce environments. Once inside, they can harvest valuable metadata, credentials, AWS keys, Snowflake tokens, and more.
In fact, the FBI recently issued a Flash alert that surfaced numerous indicators of compromise linked to these Salesforce environment attacks and warned organizations to harden defenses. The cumulative toll is staggering. ShinyHunters asserts it has stolen over 1.5 billion Salesforce records across some 760 companies.
7 ways to protect yourself from breaches like Stellantis
Even if only contact details were exposed, that’s enough for attackers to target you. Here’s how to stay protected.
Watch the latest episode of The CyberGuy Report.
Missed this event? Sign up via the registration form and see our live recording.
See Kurt’s latest Amazon picks for useful gadgets, smart home upgrades and everyday tech worth grabbing while the deals last.
1) Clean up exposed personal data from the web
Even basic contact details can be scraped from breaches and sold on data broker platforms, where they are used for spam, scams, and targeted attacks. A data removal service can help track down and request the deletion of your information from these databases, reducing your long-term exposure.
While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.
Incogni, a service I trust 100% and use myself, helps automate the process by submitting removal requests to hundreds of data brokers and people-search sites on your behalf.
Incogni automatically contacts data brokers on your behalf and requests the removal of your personal information. It also continues monitoring those sites and submits new removal requests if your data reappears.
- Incogni currently removes personal data from 420+ data broker and people-search websites, and its Unlimited plan allows you to request removals from as many additional sites as you need.
- Incogni has also received third-party assurance from Deloitte, validating its marketing claims.
- The goal is simple: make it much harder for strangers, scammers, and cybercriminals to find your personal information online.
CyberGuy readers get 60% off Incogni’s annual plans using the links in this article.
The service also includes a 30-day money-back guarantee, so you can try it risk-free and see how much of your information is exposed online.
Is your personal information exposed online?
Run a free scan to see if your personal info is compromised. Results arrive by email in about an hour.
2) Stay alert for phishing attempts and use antivirus software
The most immediate risk after a breach like this is targeted phishing. Attackers now have legitimate contact details, so their emails and texts can look convincingly real. Be skeptical of any message claiming to be from Stellantis, your car brand, or a related service, especially if it urges you to click a link, download an attachment, or share personal details.
The best way to safeguard yourself from malicious links is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.
- Strong real-time protection against viruses, malware, ransomware and hacking attempts
- AI-powered scam protection to help identify suspicious emails, texts and websites
- Built-in password manager to securely store and manage logins
- 2 GB PC cloud backup to help protect important files from ransomware or hardware failure
- Smart firewall and phishing protection
- Protects 1, 3 or 5 devices
- Available for Windows, macOS, Android and iOS
- Includes real-time threat protection, smart firewall and phishing protection to guard against online attacks
3) Use a password manager to secure your accounts
If attackers get your contact information, they may try the same password on other sites. This is called credential stuffing. A password manager can create strong, unique passwords for every account. That way, one breach will not put your other accounts at risk. It also helps you quickly update credentials in case you suspect a compromise.
Next, see if your email has been exposed in past breaches. Our #1 pick, NordPass, includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.
- Unlimited password storage
- Secure sharing
- Password health reports
- Auto-fill and emergency access
- Data breach monitoring to alert you if your credentials have been exposed
- A Security Dashboard with tools like the Data Breach Scanner and Password Health Checker to identify weak, reused, or compromised passwords
CyberGuy Exclusive Deal: Save 52% now with CyberGuy’s exclusive NordPass offer – Get 1 extra month FREE with a 2-year plan. Try 30 days risk-free for only $1.43 per month!
4) Enable two-factor authentication (2FA) wherever possible
2FA adds an extra step to your logins by requiring a temporary code or approval in addition to your password. Even if attackers manage to steal your password, they will need that second factor to gain access. This significantly reduces the chances of account takeover attempts succeeding.
5) Invest in identity theft protection
Attackers often combine exposed contact information with other data to build complete identity profiles. Identity theft protection services monitor for suspicious activity, such as unauthorized credit applications or changes to official records, and alert you early so you can act before serious damage occurs. Identity Theft companies can monitor personal information like your Social Security Number (SSN), phone number, and email address, and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.
One of the best parts of my top pick, Aura Identity Protection, is its all-in-one approach to safeguarding your personal and financial life. Aura includes identity theft insurance of up to $1 million per adult to cover eligible losses and legal fees, plus 24/7 U.S.-based fraud resolution support with dedicated case managers ready to help restore your identity fast.
Exclusive CyberGuy deal: Save up to 68% today: Get Aura’s award-winning identity theft protection and credit monitoring for as low as $9/month when billed annually.
See my full list of trusted identity theft protection services and expert tips to stay safe online.
6) Regularly review account activity
After a breach, it is worth auditing your accounts, not just with Stellantis but also with related services such as financing portals, insurance accounts, or loyalty programs. Look for unusual sign-ins, unfamiliar devices, or changes to your personal details. Most services offer tools to review login history and security events, making checking these a routine habit.
Related Links:
- Shamos malware tricks Mac users with fake fixes
- Capital One Venture X unlocks free airport lounge access
- Notorious people search site returns after massive breach
Kurt’s key takeaway
Even giants in manufacturing are vulnerable when cloud platforms and third party systems are part of their customer workflow. The same patterns seen in attacks on Google, LVMH, and others have now reached the auto industry in a serious way. As Stellantis confronts the fallout, the broader lesson is clear. Organizations must treat the surfaces exposed by their service providers and SaaS integrations with as much vigilance as their own core systems.
Do you trust companies to secure your data, or do you feel they’re not doing enough? Let us know in the comments below.
FOR MORE OF MY TECH TIPS & SECURITY ALERTS, SUBSCRIBE TO MY FREE CYBERGUY REPORT NEWSLETTER HERE
Copyright 2025 CyberGuy.com. All rights reserved. CyberGuy.com articles and content may contain affiliate links that earn a commission when purchases are made.
🎙 Now Streaming: My New Podcast: The CyberGuy Report
Kurt’s Top Deals
Deals move fast and inventory can be limited, so don’t wait too long.
| 🔥 Editor’s pick  Summer entertaining Ninja SLUSHi Machine (26% off) Frozen drinks and slushies at home in minutes. | |
| 💰 Top deal  Outdoor essential TYPEC Solar Bug Zapper (36% off) Solar-powered bug zappers for patios and camping. |
2 comments
What!?!?! Another data breach? No kidding. Sorry for the sarcasm but it is due not to you but our leaders who are sitting ldly by and doing nothing. Why is it we have to jump through hoops and pay 3rd parties to remove our information that we never willingly gave away in the first place? Thanks, as always for sharing such valuable info. And have you noticed how many of these breaches are because of 3rd party caretakers, etc.
I am wondering if now is the time we start to consider some sort of fine or penalties levied against these big corporations who fail their customers by having lax security measures on their systems that store sensitive information. This is seemingly happening more and more. I would be petrified of handing over my sensitive information to services like Life Lock for fear THEIR systems would be breached and they would have everything!!!!!!!